2016-11-21-2nd-run-EITest-Rig-standard-payload-CryptFile2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2016-11-21-2nd-run-EITest-Rig-standard-payload-CryptFile2.exe
Size 81KB
Sample250709-vw28ea1yes
SHA256 f2dbf29985a759e73c6a515422e218e6b0a1a844a327917428a1f9a1248f2320
MD5 03efa23cb13898fdfda7821ea7dc5e10
SHA1 e25e2f68f0c159378f133d0e161a980d7f148a91
SHA512 eb7afaac956b2781c4551cec46c97c4b9dee08b29844f9551ad8ff7fe766f48a9897288a3f8f514789f4f3dabc4d00ec2284c5602b4b253ca7cfc8ac393280c5
SSDEEP 1536:WqcJ/2POlymkGECwdqnUzyQon3f+RltHWSqTWfY:WPynRDcnUzyfn3WRltH7XfY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2016-11-21-2nd-run-EITest-Rig-standard-payload-CryptFile2.exe

File Explorer

2016-11-21-2nd-run-EITest-Rig-standard-payload-CryptFile2.exe

.exe 81KB

2016-11-21-2nd-run-EITest-Rig-standard-payload-CryptFile2.exe

IMPHASH 6e4610f91fe72e342925be31ea0e87c3
SHA256 f2dbf29985a759e73c6a515422e218e6b0a1a844a327917428a1f9a1248f2320
MD5 03efa23cb13898fdfda7821ea7dc5e10
SHA1 e25e2f68f0c159378f133d0e161a980d7f148a91
SHA512 eb7afaac956b2781c4551cec46c97c4b9dee08b29844f9551ad8ff7fe766f48a9897288a3f8f514789f4f3dabc4d00ec2284c5602b4b253ca7cfc8ac393280c5
SSDEEP 1536:WqcJ/2POlymkGECwdqnUzyQon3f+RltHWSqTWfY:WPynRDcnUzyfn3WRltH7XfY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6367

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetUserDefaultLCID GetCommandLineA WideCharToMultiByte lstrcpynW RtlMoveMemory VirtualAlloc GetCurrentProcessId GetHandleInformation DecodeSystemPointer GetCommConfig DefineDosDeviceA DisableThreadLibraryCalls LoadLibraryA LocalAlloc GetThreadLocale LockResource GetProcAddress FindResourceA GetCurrentThread CreateFileA GetModuleHandleW VirtualFree GetStringTypeW LCMapStringW MultiByteToWideChar LCMapStringA GetLocaleInfoA HeapSize RtlUnwind HeapReAlloc HeapAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount GetSystemTime lstrcatW SetEndOfFile GlobalAlloc FormatMessageA FreeEnvironmentStringsA CompareStringA GetFullPathNameA GetEnvironmentVariableA HeapDestroy GetStringTypeA SetStdHandle FatalAppExitA RaiseException WriteFileEx GetVersion IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoA SetUnhandledExceptionFilter Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetEnvironmentStrings FreeEnvironmentStringsW GetLastError GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate HeapFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection TerminateProcess GetCurrentProcess

user32

DefWindowProcA GetCursorPos GetKeyboardLayout SetWindowPos CheckRadioButton GetSysColor AttachThreadInput LoadImageW CheckMenuRadioItem SetTimer DialogBoxParamW SendMessageA SetClipboardData SetDlgItemTextA GetDlgItemTextA DestroyMenu GetDesktopWindow GetDlgItemTextW SendMessageW TranslateAcceleratorW GetMenuItemCount TrackPopupMenu CreateDialogParamA

gdi32

SelectObject DeleteObject SetDIBits CreateCompatibleDC GetObjectW EndPage SetWindowExtEx SetBkColor StartDocA DeleteDC

advapi32

RegQueryValueExW RegOpenKeyA RegCreateKeyA QueryServiceStatus LookupPrivilegeValueA

shell32

Shell_NotifyIconA