b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
Size 5.2MB
Sample250112-wde6lavmap
SHA256 b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb
MD5 54e383ca658ebd3caaf586f032f1c401
SHA1 bc013aace5491c65a869e944123a4344cea6c1f0
SHA512 4d10c2f888b5f56b59341e1dee5c53f56f2d81a9034eda36182bfd04246274d1fdee85b3ceccd5677ae8608626c2952ddd30fbe730dac54e405983c2a35fe51c
SSDEEP 49152:UTyQOnGEoOozdSv3U4Yn0+U0vN52S7aoRPWicuRX3EYqDqmjVNiIhnU/hHYBWZh0:KSv31WaZlah4q1W61nH/a
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe

File Explorer

b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe

.exe 5.2MB

b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe

IMPHASH ce5f91eb3b1ebc7df7d7ab97a153e7b7
SHA256 b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb
MD5 54e383ca658ebd3caaf586f032f1c401
SHA1 bc013aace5491c65a869e944123a4344cea6c1f0
SHA512 4d10c2f888b5f56b59341e1dee5c53f56f2d81a9034eda36182bfd04246274d1fdee85b3ceccd5677ae8608626c2952ddd30fbe730dac54e405983c2a35fe51c
SSDEEP 49152:UTyQOnGEoOozdSv3U4Yn0+U0vN52S7aoRPWicuRX3EYqDqmjVNiIhnU/hHYBWZh0:KSv31WaZlah4q1W61nH/a
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3558908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

darkfunk.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

Sleep GetModuleHandleA GetCurrentThreadId GetSystemTimeAsFileTime GetOverlappedResult FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread WaitForSingleObject ReadFile GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW SetFileInformationByHandle SetFilePointerEx GetStdHandle GetCurrentProcessId WriteFileEx SleepEx GetExitCodeProcess QueryPerformanceFrequency PostQueuedCompletionStatus HeapFree HeapReAlloc lstrlenW ReleaseMutex GetQueuedCompletionStatusEx FindNextFileW FindClose CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileW DeleteFileW GetFinalPathNameByHandleW CreateEventW CancelIo CreateIoCompletionPort GetConsoleMode SetHandleInformation FormatMessageW GetModuleFileNameW ExitProcess CreateNamedPipeW ReadFileEx WaitForMultipleObjects GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateThread GetProcessHeap HeapAlloc WaitForSingleObjectEx LoadLibraryA CreateMutexA DuplicateHandle GetCurrentProcess SetFileCompletionNotificationModes InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter CloseHandle GetProcAddress GetModuleHandleW QueryPerformanceCounter IsProcessorFeaturePresent

user32

SystemParametersInfoW

advapi32

RegQueryValueExW RegOpenKeyExW SystemFunction036 RegCloseKey

ws2_32

send recv shutdown ioctlsocket connect bind WSASocketW getsockname getpeername getsockopt setsockopt WSAIoctl WSAGetLastError WSAStartup WSACleanup freeaddrinfo getaddrinfo closesocket WSASend

secur32

ApplyControlToken FreeCredentialsHandle AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA DecryptMessage EncryptMessage

crypt32

CertDuplicateStore CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateCertificateContext CertFreeCertificateChain CertOpenStore CertDuplicateCertificateChain CertCloseStore

ntdll

NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtReadFile NtWriteFile NtCancelIoFileEx

bcrypt

BCryptGenRandom

vcruntime140

__current_exception_context __C_specific_handler __current_exception _CxxThrowException memcmp memmove memset memcpy __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

round pow __setusermatherr truncf roundf powf exp2f ceil

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _seh_filter_exe _get_initial_narrow_environment _initterm _initterm_e _crt_atexit _set_app_type exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _initialize_onexit_table _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode