xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7[.]exe

General

Target
xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe
Size 6.0MB
Sample260205-bmfs9scz8d
SHA256 bad80b145550725bee88caa50d095c8fd8cf50ecc8d7d2bf532ac862a5d1d402
MD5 c4d24e19ade97cbaa572a32e4c90abf4
SHA1 9793876737fccdc492f52dbbc0dea30e65236cbe
SHA512 10b5f06b543d5626ea4fbc62528f3e90b3578ef4dfd9b91d359a708f1e97663e2006171b2ca50b9fbd3a90eecadc7f537313a66a0bd2610202a545f9c0a9b3fe
SSDEEP 49152:7yxTOqc4zOGJ9l3IraB5wyoN+3zHCpj/bKtPtOr/TVz:oJJXQa4y/mpj/0Oz
TLSH
T18256D081807E0760C270F03E5623356F17BB3FE64689D2EBE8E8DD439C5B858E959AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe

File Explorer

xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe

.exe 6.0MB

xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe

IMPHASH 2f70eb106e1135b4eeb96dee2b06a134
SHA256 bad80b145550725bee88caa50d095c8fd8cf50ecc8d7d2bf532ac862a5d1d402
MD5 c4d24e19ade97cbaa572a32e4c90abf4
SHA1 9793876737fccdc492f52dbbc0dea30e65236cbe
SHA512 10b5f06b543d5626ea4fbc62528f3e90b3578ef4dfd9b91d359a708f1e97663e2006171b2ca50b9fbd3a90eecadc7f537313a66a0bd2610202a545f9c0a9b3fe
SSDEEP 49152:7yxTOqc4zOGJ9l3IraB5wyoN+3zHCpj/bKtPtOr/TVz:oJJXQa4y/mpj/0Oz
TLSH
T18256D081807E0760C270F03E5623356F17BB3FE64689D2EBE8E8DD439C5B858E959AD1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6100604

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

ShowWindow

kernel32

FreeLibrary SetEndOfFile DeleteFileA CloseHandle GetCurrentProcess GetCurrentThread GetTickCount GetModuleHandleA GetProcAddress GetConsoleWindow WriteConsoleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize

Name

.text

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

xbad80b145550725bee88caa50d095c8fd8cf50ecc8d7.exe

user32

kernel32

generic