4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29[.]exe

Resubmissions

30/04/2026, 02:38

260430-c45dmad19j10

18/10/2025, 02:40

251018-c56cbag16d10

Sharing

Copy URL Twitter E-mail

General

Target
4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe
Size 1.8MB
Sample251018-c56cbag16d
SHA256 4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29
MD5 18498b1ff111ee9d9a037c280f75b720
SHA1 0e9a47782e39741a2c161bf639252d33ad3a428a
SHA512 c578122532d223d55a752f89bc72a22127e791d967728cbd527df54cd5aac1471642183aa4a29f310646679eb753919a2ac02b9b51437bb504dd48e24211d80a
SSDEEP 24576:jZgTpNZ+WIp82mx6gq+Jn5tNj32+t40VzQJSGR8cknOuP3S+hpDTFMs2UWz7vs75:WbnbdG+t40VzMSGR8zdpDTKs2N7YJlF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe

File Explorer

4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe

.exe 1.8MB

4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe

IMPHASH 6aa4f710b53d1ce1569c980be652fdb9
SHA256 4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29
MD5 18498b1ff111ee9d9a037c280f75b720
SHA1 0e9a47782e39741a2c161bf639252d33ad3a428a
SHA512 c578122532d223d55a752f89bc72a22127e791d967728cbd527df54cd5aac1471642183aa4a29f310646679eb753919a2ac02b9b51437bb504dd48e24211d80a
SSDEEP 24576:jZgTpNZ+WIp82mx6gq+Jn5tNj32+t40VzQJSGR8cknOuP3S+hpDTFMs2UWz7vs75:WbnbdG+t40VzMSGR8zdpDTKs2N7YJlF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1324796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

encrypt.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateNamedPipeW CreateThread ReadFileEx WriteFileEx SleepEx CreateEventW MultiByteToWideChar ReadFile ExitProcess QueryPerformanceCounter QueryPerformanceFrequency HeapAlloc MoveFileExW GetFileType GetProcessTimes GetSystemTimes GetProcessIoCounters ReadProcessMemory VirtualQueryEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetConsoleOutputCP CompareStringOrdinal GetCurrentDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle CreateDirectoryW FreeLibrary SetFileInformationByHandle Sleep CreateWaitableTimerExW GetTimeZoneInformationForYear WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcess GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry CreateFileW GetFullPathNameW RtlVirtualUnwind RtlCaptureContext lstrlenW GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetStdHandle GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateMutexW GetSystemInfo HeapReAlloc GetExitCodeProcess WaitForSingleObject GetOverlappedResult WaitForMultipleObjects FindNextFileW FindFirstFileExW SetFilePointerEx GetCommandLineW GetModuleFileNameW SetLastError FormatMessageW SetFileAttributesW OpenProcess TerminateProcess GetCurrentProcessId LocalFree FindClose GetConsoleWindow K32GetPerformanceInfo GetLastError GetModuleHandleW GlobalMemoryStatusEx GetModuleHandleA GetSystemTimePreciseAsFileTime CloseHandle SwitchToThread HeapFree GetProcessHeap GetEnvironmentVariableW SetWaitableTimer WriteConsoleW CancelIo

bcrypt

BCryptGenRandom

advapi32

LookupPrivilegeValueA ConvertSidToStringSidW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW RegSetValueExW RegCreateKeyExW CloseServiceHandle ControlService GetNamedSecurityInfoW ConvertStringSidToSidW GetLengthSid GetSecurityInfo SystemFunction036 OpenSCManagerA AddAccessDeniedAceEx CopySid IsValidAcl GetAclInformation InitializeAcl GetAce IsValidSid EqualSid AddAce SetSecurityInfo SetNamedSecurityInfoW AddMandatoryAce EnumServicesStatusA OpenProcessToken AddAuditAccessAceEx AddAccessAllowedAceEx GetTokenInformation OpenServiceA

user32

RegisterClassW RegisterWindowMessageW GetMenuItemID SetForegroundWindow DefWindowProcW TrackPopupMenu PostMessageW ShowWindow GetCursorPos TranslateMessage LoadIconW InsertMenuItemW DispatchMessageW CreateIconFromResourceEx CreatePopupMenu SetMenuInfo PostQuitMessage GetMessageW CreateWindowExW

rstrtmgr

RmGetList RmRegisterResources RmEndSession RmStartSession

shell32

CommandLineToArgvW Shell_NotifyIconW

ntdll

NtWriteFile NtQueryInformationProcess NtQuerySystemInformation RtlGetVersion RtlNtStatusToDosError NtReadFile

pdh

PdhAddEnglishCounterW PdhRemoveCounter PdhCloseQuery PdhOpenQueryA PdhCollectQueryData PdhGetFormattedCounterValue

oleaut32

GetErrorInfo SysFreeString SysStringLen

psapi

GetModuleFileNameExW

powrprof

CallNtPowerInformation

vcruntime140

__C_specific_handler __current_exception __current_exception_context _CxxThrowException memcpy memcmp memset memmove __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit exit _initterm_e _initterm __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _exit terminate _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale