5eadbfcfb7a040f56436004dc093cb57f766f17777544efa1d7457fbc21b62b4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5eadbfcfb7a040f56436004dc093cb57f766f17777544efa1d7457fbc21b62b4.exe
Size 2.0MB
Sample251009-sdjbgafm6v
SHA256 5eadbfcfb7a040f56436004dc093cb57f766f17777544efa1d7457fbc21b62b4
MD5 3f2567c3f4dc8181768d25abe97d4f5b
SHA1 5fa712576feadbf31ae43119e8e5e99021c3e164
SHA512 f406d9e978f104b0c9444fe2c3ffe838f3edbc0335a023bee20ad3b506eebf16a918718561681fc7d300c42bd9c9e4cb5eaa571bdee2d3f9451ced32a2ca30b2
SSDEEP 24576:wMSOGKOCmX0658qvjsnsub41U+41InsqbHf1H2EeA6/6qVhO4DckQZivKKuIvC6p:wMSF58ajXWUetuZivK3KCF7S
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5eadbfcfb7a040f56436004dc093cb57f766f17777544efa1d7457fbc21b62b4.exe

File Explorer

5eadbfcfb7a040f56436004dc093cb57f766f17777544efa1d7457fbc21b62b4.exe

.exe 2.0MB

5eadbfcfb7a040f56436004dc093cb57f766f17777544efa1d7457fbc21b62b4.exe

IMPHASH a52e8f8e1c1b68e2fd240c94f73e7cce
SHA256 5eadbfcfb7a040f56436004dc093cb57f766f17777544efa1d7457fbc21b62b4
MD5 3f2567c3f4dc8181768d25abe97d4f5b
SHA1 5fa712576feadbf31ae43119e8e5e99021c3e164
SHA512 f406d9e978f104b0c9444fe2c3ffe838f3edbc0335a023bee20ad3b506eebf16a918718561681fc7d300c42bd9c9e4cb5eaa571bdee2d3f9451ced32a2ca30b2
SSDEEP 24576:wMSOGKOCmX0658qvjsnsub41U+41InsqbHf1H2EeA6/6qVhO4DckQZivKKuIvC6p:wMSF58ajXWUetuZivK3KCF7S
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

439044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\WINDOWS\msil_ipamexpiry_31bf3856ad364e35_10.0.26100.1_none_399e97941bd82763\txt\mpp\2.pdb

advapi32

RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptSetProperty BCryptOpenAlgorithmProvider BCryptImportKey BCryptDestroyKey BCryptDestroyHash BCryptHashData BCryptGetProperty BCryptFinishHash BCryptDecrypt BCryptEncrypt BCryptCreateHash BCryptGenRandom BCryptCloseAlgorithmProvider

kernel32

RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetLastError GetConsoleScreenBufferInfo GetLastError SetConsoleTextAttribute GetStdHandle RaiseFailFastException GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName FindStringOrdinal GetTickCount64 GetCurrentProcess GetCurrentThread Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx QueryPerformanceFrequency LocalAlloc GetConsoleOutputCP WideCharToMultiByte GetProcAddress LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx ExpandEnvironmentStringsW FreeLibrary GetModuleFileNameW LoadLibraryExW SetThreadErrorMode DuplicateHandle GetThreadPriority WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx VirtualQuery GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId

ole32

CoUninitialize CoTaskMemAlloc CoGetApartmentType CoWaitForMultipleHandles CoInitializeEx

api-ms-win-crt-math-l1-1-0

ceil __setusermatherr

api-ms-win-crt-heap-l1-1-0

_callnewh calloc malloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

wcsncmp strncpy_s _stricmp strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _c_exit abort _cexit __p___wargv _crt_atexit __p___argc _exit terminate exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vsscanf _set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

446KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

681KB

Virtual Size

681KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

842KB

Virtual Size

842KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

580B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5eadbfcfb7a040f56436004dc093cb57f766f17777544efa1d7457fbc21b62b4.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic