d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18.exe
Size 205KB
Sample250707-ehy1tsfn2x
SHA256 d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18
MD5 08759d9ea2712d693891c870bbebbde3
SHA1 00454046c6be47839226fc55da5bc492e5d4f99c
SHA512 8e00e74b1729819026e0405d11424a499e6d7bb945b278823d45331091a079ad923edaef7d9a57c1763ca6acf8ea52b8bc26589df88ad8ceef48ff9f6b0adc15
SSDEEP 3072:m0rcKaNFQBcEu6rBUUhwnHvZt101gqOZ4nsmovBOO25uKDA:m0paNFu/u6r1wnRUKCc2M+A
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18.exe

File Explorer

d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18.exe

.exe 205KB

d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18.exe

IMPHASH 8b1b74c5acaa3433cd0a3f4678ea1fca
SHA256 d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18
MD5 08759d9ea2712d693891c870bbebbde3
SHA1 00454046c6be47839226fc55da5bc492e5d4f99c
SHA512 8e00e74b1729819026e0405d11424a499e6d7bb945b278823d45331091a079ad923edaef7d9a57c1763ca6acf8ea52b8bc26589df88ad8ceef48ff9f6b0adc15
SSDEEP 3072:m0rcKaNFQBcEu6rBUUhwnHvZt101gqOZ4nsmovBOO25uKDA:m0paNFu/u6r1wnRUKCc2M+A
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptStringToBinaryA

mpr

WNetEnumResourceW WNetCloseEnum WNetOpenEnumW

rstrtmgr

RmShutdown RmEndSession RmRegisterResources RmGetList RmStartSession

kernel32

FindNextVolumeW GetDriveTypeW ReadFile GetFileSizeEx SetFileTime GetQueuedCompletionStatus GetFileAttributesW PostQueuedCompletionStatus SetFileAttributesW lstrcpyA MoveFileExW CreateIoCompletionPort GetFileTime GetCurrentProcess TerminateProcess WaitForMultipleObjects GetTempPathW lstrcpyW CreateToolhelp32Snapshot FormatMessageW GetTickCount64 FindNextFileW Process32FirstW GetSystemInfo SetFilePointerEx LocalFree GetCurrentProcessId FormatMessageA GetConsoleWindow SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP GetVolumePathNamesForVolumeNameW FindVolumeClose SetVolumeMountPointW CreateThread CloseHandle lstrcatW Sleep CreateFileW WaitForSingleObject FindClose DeviceIoControl WriteFile OpenProcess IsValidCodePage FindFirstFileExW GetFileType FindFirstVolumeW FindFirstFileW GetProcessHeap HeapAlloc lstrlenA HeapFree lstrcmpiW GetLastError GetCommandLineW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc WriteConsoleW lstrlenW Process32NextW LCMapStringW CompareStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA FlsAlloc FlsGetValue FlsSetValue FlsFree

user32

GetDC SystemParametersInfoW ReleaseDC ShowWindow DrawTextA GetSystemMetrics

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection GetTextExtentPoint32A CreateCompatibleDC CreateFontW DeleteDC SetTextColor SetBkMode SetBkColor DeleteObject

winspool.drv

EnumPrintersW WritePrinter ClosePrinter StartPagePrinter EndDocPrinter EndPagePrinter StartDocPrinterW OpenPrinterW

advapi32

SetEntriesInAclW QueryServiceStatusEx CryptAcquireContextW CryptGenRandom CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid RegOpenKeyW SetNamedSecurityInfoW ControlService EnumDependentServicesW RegSetValueExW OpenProcessToken FreeSid EnumServicesStatusExW OpenServiceW

shell32

SHEmptyRecycleBinA CommandLineToArgvW