6fed3ad0ae75cde3fb269a8d09057871997f292a6628687a2fd331c640d52320[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6fed3ad0ae75cde3fb269a8d09057871997f292a6628687a2fd331c640d52320.exe
Size 208KB
Sample250113-bc8rasxqdv
SHA256 6fed3ad0ae75cde3fb269a8d09057871997f292a6628687a2fd331c640d52320
MD5 0321b94618ebdcf82050a2bacfbe0e91
SHA1 6c4e64f7fb64b25d82209147304b7e1f30961ff6
SHA512 2982ea047d169f872523f722a50a62e926ed48e016d8e820419a9d2d24d22e3cf762cecff0d1d82abeacacecc3638d8b35dca712b521db7a4db181e0dd7bd8a2
SSDEEP 6144:ta1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkA:tbapK0JCmRcU9vVokfZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fed3ad0ae75cde3fb269a8d09057871997f292a6628687a2fd331c640d52320.exe

File Explorer

6fed3ad0ae75cde3fb269a8d09057871997f292a6628687a2fd331c640d52320.exe

.exe 208KB

6fed3ad0ae75cde3fb269a8d09057871997f292a6628687a2fd331c640d52320.exe

IMPHASH e391eee2fda3671a828f8ce7165ca399
SHA256 6fed3ad0ae75cde3fb269a8d09057871997f292a6628687a2fd331c640d52320
MD5 0321b94618ebdcf82050a2bacfbe0e91
SHA1 6c4e64f7fb64b25d82209147304b7e1f30961ff6
SHA512 2982ea047d169f872523f722a50a62e926ed48e016d8e820419a9d2d24d22e3cf762cecff0d1d82abeacacecc3638d8b35dca712b521db7a4db181e0dd7bd8a2
SSDEEP 6144:ta1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkA:tbapK0JCmRcU9vVokfZ
MD5 SHA1 SHA512 SSDEEP

windows:2 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SearchPathA GetModuleHandleW ConnectNamedPipe GetModuleFileNameA EnumTimeFormatsW SuspendThread GetWindowsDirectoryW GetPriorityClass lstrlen CreateThread GetSystemDefaultLangID FlushFileBuffers ReadDirectoryChangesW GetDateFormatA BeginUpdateResourceW FreeResource GetSystemDirectoryA CreateMutexW GetModuleFileNameW GetModuleHandleA LoadLibraryW FatalAppExitA SetLocaleInfoW GetProcessHeap GetDiskFreeSpaceA GetProcAddress FindResourceA GetOEMCP lstrcpyW GetThreadPriority GlobalGetAtomNameW MoveFileW CompareStringA LocalFree MultiByteToWideChar GetVersionExW GetACP

user32

LoadMenuIndirectA UnregisterClassW GetClassInfoExW RegisterClassA GetClassNameA LoadMenuW DefDlgProcW SetWindowRgn GetParent DialogBoxIndirectParamA LoadMenuA GetClassInfoW DrawTextW CreateDialogIndirectParamW wvsprintfA LoadCursorW EnumWindows DialogBoxIndirectParamW CharNextW FindWindowW GetDCEx GetSysColor GetMenuStringW GetTopWindow LoadBitmapA TrackPopupMenuEx AppendMenuW InsertMenuItemA GetWindowRect MessageBoxW SetActiveWindow EnumDesktopsA CreatePopupMenu FindWindowA MessageBoxIndirectW CreateAcceleratorTableW CharLowerA DeleteMenu GetForegroundWindow EnumDesktopWindows EnumDesktopsW CopyRect OpenClipboard GetDlgItemTextW GetWindowLongW GetMenuItemCount CheckDlgButton CreateAcceleratorTableA WaitForInputIdle DialogBoxParamW PostQuitMessage GetActiveWindow CreateCaret RegisterWindowMessageW GetClassNameW GetMenuItemInfoA EndMenu WinHelpA SetCapture SetTimer CreateMenu CreateDialogParamA SendDlgItemMessageA LoadCursorA DefWindowProcW EnumDesktopsA SetMenu

gdi32

GetBrushOrgEx StrokeAndFillPath CreateFontW GetEnhMetaFilePixelFormat GetPixel GetViewportOrgEx CreateDCA CopyMetaFileW AbortPath RemoveFontResourceA GetKerningPairsA EnumFontFamiliesExW AddFontResourceW Rectangle GetDeviceGammaRamp PolyPolygon RectInRegion GetGlyphIndicesA CreatePolygonRgn SetColorSpace SetMetaFileBitsEx CreateBitmap OffsetRgn EndDoc CreateDIBPatternBrush PlayEnhMetaFile RestoreDC GetCharWidth32W PaintRgn StartFormPage

advapi32

RegDeleteKeyW RegOpenKeyA RegQueryMultipleValuesW RegEnumValueW RegSetValueA RegEnumKeyExA RegCreateKeyExA RegRestoreKeyW RegCloseKey RegEnumKeyA RegEnumKeyW RegDeleteValueA RegQueryValueW RegReplaceKeyW RegFlushKey CryptSetProviderA RegOpenKeyW RegEnumValueA

shell32

ExtractIconExA

comctl32

ImageList_SetImageCount ImageList_Duplicate FlatSB_EnableScrollBar DllGetVersion ImageList_SetBkColor InitCommonControls ImageList_GetBkColor

comdlg32

FindTextA LoadAlterBitmap ReplaceTextW GetFileTitleW GetSaveFileNameW ReplaceTextA

oleaut32

VarR8FromDisp VarUI1FromStr VarDateFromUI8 OleLoadPictureFile VarUI1FromDisp VarUI8FromCy

wininet

GopherGetLocatorTypeA ShowCertificate HttpQueryInfoA SetUrlCacheHeaderData FindFirstUrlCacheContainerA GetUrlCacheEntryInfoA FindNextUrlCacheContainerA DeleteUrlCacheEntry InternetGetConnectedState GetUrlCacheConfigInfoW InternetConfirmZoneCrossing InternetGetConnectedStateEx InternetCreateUrlA CreateUrlCacheEntryA InternetSetPerSiteCookieDecisionW InternetSetOptionW RetrieveUrlCacheEntryFileW FindCloseUrlCache UrlZonesDetach

urlmon

IsValidURL CoInternetCreateSecurityManager URLDownloadToCacheFileW Extract MkParseDisplayNameEx GetMarkOfTheWeb CopyStgMedium HlinkNavigateMoniker

wsock32

GetAddressByNameA GetAddressByNameW s_perror WSAAsyncGetProtoByNumber socket WSAAsyncGetHostByName send AcceptEx shutdown

crypt32

CertFreeCRLContext CertGetIntendedKeyUsage CertGetNameStringW PFXExportCertStoreEx CryptVerifyMessageHash CertGetIssuerCertificateFromStore I_CryptEnableLruOfEntries I_CryptGetAsn1Decoder CertEnumSystemStoreLocation I_CryptSetTls

Name

.ehkoKk

Size

2KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.WbOYt

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.jVQpnF

Size

1KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.MAgzG

Size

109KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6fed3ad0ae75cde3fb269a8d09057871997f292a6628687a2fd331c640d52320.exe

kernel32

user32

gdi32

advapi32

shell32

comctl32

comdlg32

oleaut32

wininet

urlmon

wsock32

crypt32

generic