639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c.exe
Size 850KB
Sample250825-cnsd5azzcx
SHA256 639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c
MD5 0fa29a85e76fb02dcdea5987f6a068ef
SHA1 147ceda512a398c7d6a8f0ba4ec067cfdef9bcc2
SHA512 0d63f60dff7def09b615fb9044a35541816bdc060906f32767e0cb317af46b15f312227043f3599e95c67d8ea746207897708e0c83f2e9aa46451f589a453615
SSDEEP 12288:bcGQfV0Sl+S4aXp6ohkcXEUkuWFn9jxYAti9ShR07BRcRsEMxj/moTksyYqKEks6:Inl+SHEUkpnEAXf07fcu/hEHjkL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c.exe

File Explorer

639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c.exe

.exe 850KB

639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c.exe

IMPHASH d0231af7b7ffd7e4a5f35f5a2f235ca7
SHA256 639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c
MD5 0fa29a85e76fb02dcdea5987f6a068ef
SHA1 147ceda512a398c7d6a8f0ba4ec067cfdef9bcc2
SHA512 0d63f60dff7def09b615fb9044a35541816bdc060906f32767e0cb317af46b15f312227043f3599e95c67d8ea746207897708e0c83f2e9aa46451f589a453615
SSDEEP 12288:bcGQfV0Sl+S4aXp6ohkcXEUkuWFn9jxYAti9ShR07BRcRsEMxj/moTksyYqKEks6:Inl+SHEUkpnEAXf07fcu/hEHjkL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_AGGRESIVE_WS_TRIM IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_SYSTEM IMAGE_FILE_UP_SYSTEM_ONLY

PDB paths

kernel32

InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc LoadLibraryW SetFilePointer DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount LeaveCriticalSection SetLastError GetModuleFileNameW WriteFile IsProcessorFeaturePresent EncodePointer IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RaiseException GetStartupInfoW HeapSetInformation GetCommandLineA GetCurrentThreadId InterlockedDecrement GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep RtlUnwind MultiByteToWideChar SetStdHandle HeapSize WriteConsoleW LCMapStringW GetStringTypeW HeapReAlloc FlushFileBuffers ExitProcess CreateFileW lstrcpyA CloseHandle FillConsoleOutputAttribute CancelIo GetModuleHandleA LockResource GetConsoleScreenBufferInfo LoadLibraryA GetLocalTime GetProcAddress GetLastError GetStdHandle SetConsoleCursorPosition HeapCreate GetVersionExW SizeofResource FindResourceExA FormatMessageA FlushConsoleInputBuffer WaitForSingleObject GetCurrentProcess DecodePointer GetModuleHandleW HeapFree HeapAlloc LoadResource SetLocalTime FillConsoleOutputCharacterA EnterCriticalSection

user32

DialogBoxParamA MoveWindow CheckMenuItem GetWindow EndPaint ClientToScreen CloseClipboard GetWindowRect RegisterClassExA PostQuitMessage SendDlgItemMessageA GetSubMenu DrawIconEx CopyImage LoadBitmapA GetParent LoadIconA GetClientRect SendMessageA BeginPaint GetDC GetMenu MessageBoxA UnregisterClassA CreateWindowExA GetDCEx ReleaseDC EmptyClipboard GetDlgItem EndDialog DefWindowProcA SendMessageTimeoutA SetWindowPos ShowWindow GetSysColorBrush IsWindow OpenClipboard IsWindowVisible SetWindowTextA LoadImageA UpdateWindow EnableWindow SetClipboardData LoadCursorA

gdi32

MoveToEx BitBlt PatBlt DeleteDC CreateDIBSection CreateFontA CreateFontIndirectA GetCurrentObject SetDIBColorTable SetPixel DeleteObject SelectObject GetPaletteEntries CreateCompatibleDC CreateCompatibleBitmap GdiAlphaBlend CreateBitmapIndirect SetTextJustification GetTextMetricsA SetTextAlign GetPixel GetObjectA GetStockObject CreateSolidBrush TextOutA

advapi32

AllocateAndInitializeSid OpenProcessToken GetTokenInformation RegSetValueExA RegQueryValueExA RegCloseKey GetLengthSid IsValidSecurityDescriptor FreeSid IsValidSid AddAccessAllowedAce IsValidAcl InitializeAcl RegQueryInfoKeyA RegCreateKeyExA LookupPrivilegeValueA SetSecurityDescriptorDacl RegCreateKeyA InitializeSecurityDescriptor

shell32

SHGetMalloc SHGetDesktopFolder

ole32

CoInitialize

shlwapi

AssocCreate

comctl32

ImageList_Add ImageList_Create

secur32

GetUserNameExA

Name

.text

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

738KB

Virtual Size

737KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.loc

Size

1024B

Virtual Size

716B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

secur32

generic