f5ed57e822e8d236cda4e4547f2d9af2caa9fb37e90406ee6dd253d014fcd8a9[.]exe

General

Target
f5ed57e822e8d236cda4e4547f2d9af2caa9fb37e90406ee6dd253d014fcd8a9.exe
Size 947KB
Sample260204-ts2l2aex7a
SHA256 f5ed57e822e8d236cda4e4547f2d9af2caa9fb37e90406ee6dd253d014fcd8a9
MD5 c2eecf5ecd198bbb4b630da83aa5cb2c
SHA1 38e427282faeac21a280ca7a815751abc964d814
SHA512 3aff91a8b3a69142f8067f6b4ea21dc55cbe04c614aaecb454fed15c74d13762c4d77e864be9a51d9875ac603efd0c667f72219a178371ca165175f4e31e9410
SSDEEP 24576:RJ4M5QU9oDpzu/lmTuMBXY7osl9NKoim6/ABZMd:RJ95xQpEIF6EslXKc6/UZE
TLSH
T188258D20B652F437E8B304B28EBCEA5E516CFD5007245DDFB3C826AD6A750D12E33696
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5ed57e822e8d236cda4e4547f2d9af2caa9fb37e90406ee6dd253d014fcd8a9.exe

File Explorer

f5ed57e822e8d236cda4e4547f2d9af2caa9fb37e90406ee6dd253d014fcd8a9.exe

.exe 947KB

f5ed57e822e8d236cda4e4547f2d9af2caa9fb37e90406ee6dd253d014fcd8a9.exe

IMPHASH 0f08693ab833479be49010b596b1e753
SHA256 f5ed57e822e8d236cda4e4547f2d9af2caa9fb37e90406ee6dd253d014fcd8a9
MD5 c2eecf5ecd198bbb4b630da83aa5cb2c
SHA1 38e427282faeac21a280ca7a815751abc964d814
SHA512 3aff91a8b3a69142f8067f6b4ea21dc55cbe04c614aaecb454fed15c74d13762c4d77e864be9a51d9875ac603efd0c667f72219a178371ca165175f4e31e9410
SSDEEP 24576:RJ4M5QU9oDpzu/lmTuMBXY7osl9NKoim6/ABZMd:RJ95xQpEIF6EslXKc6/UZE
TLSH
T188258D20B652F437E8B304B28EBCEA5E516CFD5007245DDFB3C826AD6A750D12E33696
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

431696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Legion\source\repos\Mammon\Release\Mammon.pdb

kernel32

GetLogicalDriveStringsW GetDriveTypeA GetDriveTypeW FreeConsole GetLastError FindNextFileW QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread GetThreadTimes SetEndOfFile FindFirstFileW lstrcmpW SetLastError FindClose WideCharToMultiByte MultiByteToWideChar GetStringTypeW FormatMessageW CloseHandle DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess SwitchToThread GetCurrentThreadId GetExitCodeThread EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetProcAddress CopyFileW MoveFileExW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess GetCurrentProcessId CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RaiseException RtlUnwind ExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP HeapAlloc HeapFree GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile ReadConsoleW SetFilePointerEx GetTimeZoneInformation HeapReAlloc HeapSize FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetProcessHeap SetStdHandle WriteConsoleW

advapi32

CryptReleaseContext CryptAcquireContextA CryptGenRandom

Resubmissions

Sharing