83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48N.exe
Size 218KB
Sample250205-mgpd1asmat
SHA256 83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48
MD5 96e0f884f678e5d1eb9a4c3510eba970
SHA1 6c810af7e17f0dc66dccb3836ad745b952ff77fa
SHA512 6d825c859acbd295964e8caea9a9170ad506bfd2a2a98fe55765b1278475bbc27a5d129db73323f3736ad80f9d06654ec722171cbd451d7bf8a7ef85198dee11
SSDEEP 6144:OEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICW:OEGDdQNHEwWlMxYG/wIR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48N.exe

File Explorer

83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48N.exe

.exe 218KB

83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48N.exe

IMPHASH 2e5df9fb7e893bd2efa286b6326edce6
SHA256 83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48
MD5 96e0f884f678e5d1eb9a4c3510eba970
SHA1 6c810af7e17f0dc66dccb3836ad745b952ff77fa
SHA512 6d825c859acbd295964e8caea9a9170ad506bfd2a2a98fe55765b1278475bbc27a5d129db73323f3736ad80f9d06654ec722171cbd451d7bf8a7ef85198dee11
SSDEEP 6144:OEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICW:OEGDdQNHEwWlMxYG/wIR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

570996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetStartupInfoA EnumCalendarInfoA DisconnectNamedPipe MoveFileA lstrcpyn GetCommandLineA GetSystemDirectoryW GetEnvironmentVariableA IsBadStringPtrA FindAtomW ReadDirectoryChangesW GetFullPathNameW GetFileAttributesA ExitThread LoadLibraryA lstrlenA lstrlen FindResourceA FindResourceW GetTempPathW GetFullPathNameA OpenMutexW SearchPathW GetProcAddress EnumTimeFormatsW GetLocaleInfoW EnumTimeFormatsA GetCPInfo OpenMutexA GetThreadPriority LoadResource CreateFileMappingA GetNamedPipeInfo lstrcpynW CompareStringW OpenFile IsBadCodePtr GetDiskFreeSpaceA GetTimeFormatW FindAtomA GlobalGetAtomNameW MultiByteToWideChar CreateMailslotW

user32

LoadMenuIndirectW GetDC SetCursorPos OpenClipboard CreateAcceleratorTableA OffsetRect IsDlgButtonChecked LoadMenuIndirectA GetMessageW WinHelpA UpdateWindow IsMenu GetKeyState UnregisterClassA DestroyIcon ShowWindow SetFocus TrackPopupMenuEx

gdi32

GetLogColorSpaceW EnumFontFamiliesW CreateICW OffsetClipRgn SetRectRgn SetTextColor PlayEnhMetaFile CreateFontIndirectExW GetOutlineTextMetricsW GetBrushOrgEx SetEnhMetaFileBits StartDocW GetObjectA

advapi32

RegQueryInfoKeyW RegOpenKeyExA RegQueryValueW RegReplaceKeyW RegOpenKeyExA RegQueryInfoKeyA RegDeleteKeyA RegQueryValueA RegDeleteValueA RegOpenKeyExW RegReplaceKeyA RegRestoreKeyW

shell32

SHGetDataFromIDListA SHGetFileInfoA

shlwapi

StrStrW SHOpenRegStream2A StrToIntA PathParseIconLocationA PathSkipRootW StrToIntExA PathCreateFromUrlA StrCmpNIW StrChrNIW UrlIsOpaqueA

ole32

CoGetCurrentProcess CLSIDFromString

winmm

midiOutSetVolume mxd32Message mmioClose mciSendStringW mmioSendMessage mixerGetLineControlsW mmTaskBlock

Name

.ma

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.obptK

Size

5KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Wv

Size

2KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.UeARA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rddrej

Size

3KB

Virtual Size

396KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.roXfGq

Size

3KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BOJdrg

Size

3KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.IU

Size

3KB

Virtual Size

473KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

109KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kzG

Size

1KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cMrd

Size

512B

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

634B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

83b9c68eef5d448a31a604b2f82e7f066991c30a75c24ae96364aa985299bb48N.exe

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

winmm

generic