9e3fdb1daaa9146fa27e4f99d94f56be[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
9e3fdb1daaa9146fa27e4f99d94f56be.exe
Size 175KB
Sample260317-tmp12shz2y
SHA256 68795c47a9aeb9e3208ca814fcef157c8e5f73464298e5eec4bb0ea32831baba
MD5 9e3fdb1daaa9146fa27e4f99d94f56be
SHA1 1b499b7b4ba7ed80695f2dd0fce8d94ebdc8e30e
SHA512 af1db094f4c220154fd5959ff84d2fc1c24c41f0faf693addc4b855e8e001c5ab180995710441960e58329bfdae6304aa116979bbb531bdcaaf50af9cd0a4de9
SSDEEP 3072:Ua4hbLnUPwZLQ03C1m5FLiOAnqZcaw0aRHUGRLm2iUtG:ShE4lQ0y1dr0aRHUGBmEt
TLSH
T1F0049F00F181D436F5B310B58AF69969962CBA100BA54DEFF7C809BE8F314D1BA35E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9e3fdb1daaa9146fa27e4f99d94f56be.exe

File Explorer

9e3fdb1daaa9146fa27e4f99d94f56be.exe

.exe 175KB

9e3fdb1daaa9146fa27e4f99d94f56be.exe

IMPHASH 4d1adb8c36a03a7a69c0e198ec96a536
SHA256 68795c47a9aeb9e3208ca814fcef157c8e5f73464298e5eec4bb0ea32831baba
MD5 9e3fdb1daaa9146fa27e4f99d94f56be
SHA1 1b499b7b4ba7ed80695f2dd0fce8d94ebdc8e30e
SHA512 af1db094f4c220154fd5959ff84d2fc1c24c41f0faf693addc4b855e8e001c5ab180995710441960e58329bfdae6304aa116979bbb531bdcaaf50af9cd0a4de9
SSDEEP 3072:Ua4hbLnUPwZLQ03C1m5FLiOAnqZcaw0aRHUGRLm2iUtG:ShE4lQ0y1dr0aRHUGBmEt
TLSH
T1F0049F00F181D436F5B310B58AF69969962CBA100BA54DEFF7C809BE8F314D1BA35E27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualFree VirtualAlloc VirtualQuery HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep HeapReAlloc CloseHandle HeapAlloc GetThreadContext GetProcAddress GetCurrentProcessId GetModuleHandleW FlushInstructionCache SetThreadContext OpenThread GetModuleHandleA lstrcmpiW lstrcmpA DecodePointer WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapSize GetProcessHeap LCMapStringW CompareStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW LocalFree GetLastError RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW

user32

MessageBoxA

oleaut32

VariantCopy SafeArrayDestroy VariantInit SafeArrayGetUBound SafeArrayGetLBound SysFreeString SafeArrayPutElement SafeArrayUnaccessData SafeArrayCreate SafeArrayAccessData VariantClear

shlwapi

PathFindFileNameW

mscoree

CLRCreateInstance

Name

.text

Size

76KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.tls

Size

33KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_READ

Name

ufp

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dat

Size

26KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

9e3fdb1daaa9146fa27e4f99d94f56be.exe

kernel32

user32

oleaut32

shlwapi

mscoree

generic