exs9yhm[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
exs9yhm.exe
Size 412KB
Sample260323-12ebesas4l
SHA256 98e504cc7125b79eda5491f40b998605a05f4cd968b961aab4cce7beb074fefe
MD5 a025b901a7979bff2a6c6e4e74c7c76a
SHA1 72cab50156ba4e2d5f4de97f672d4635e98ddacc
SHA512 b266b91dd14e62b8555804717e0b41e6e5096fd7b6eb31d15471398cd8abd912764c029f471b0d83bf42220282453f2fa6245cc90c5d2c0c07cb3a46e79ddbc4
SSDEEP 6144:j9n6rEDxy8DR5N2TaxKF+C7YYboMB+qTd0/bkmZKfmWGTiFpM6iAOCpvztp4:j9n6rEDx3DoFJ9gqTdkWBiMtp4
TLSH
T1FB944C213817C032D56091711F7AFFF685AD69269B7149DBBBC40E375A202D2AE31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
exs9yhm.exe

File Explorer

exs9yhm.exe

.exe 412KB

exs9yhm.exe

IMPHASH 6d1f0062d3cd177e7836b057a643ab5d
SHA256 98e504cc7125b79eda5491f40b998605a05f4cd968b961aab4cce7beb074fefe
MD5 a025b901a7979bff2a6c6e4e74c7c76a
SHA1 72cab50156ba4e2d5f4de97f672d4635e98ddacc
SHA512 b266b91dd14e62b8555804717e0b41e6e5096fd7b6eb31d15471398cd8abd912764c029f471b0d83bf42220282453f2fa6245cc90c5d2c0c07cb3a46e79ddbc4
SSDEEP 6144:j9n6rEDxy8DR5N2TaxKF+C7YYboMB+qTd0/bkmZKfmWGTiFpM6iAOCpvztp4:j9n6rEDx3DoFJ9gqTdkWBiMtp4
TLSH
T1FB944C213817C032D56091711F7AFFF685AD69269B7149DBBBC40E375A202D2AE31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

161557

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemInfo GetComputerNameExW GetVersionExW Wow64DisableWow64FsRedirection GetModuleFileNameA GetModuleHandleA GetProcAddress WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW CreateProcessA CreateThread CreateMutexA Sleep WaitForSingleObject PeekNamedPipe CreatePipe GetLastError SetHandleInformation CloseHandle GetTempPathA WriteFile RemoveDirectoryA ReadFile GetFullPathNameW GetFileAttributesA FindNextFileW FindFirstFileExW FindClose CreateFileA CreateDirectoryA Wow64RevertWow64FsRedirection SetCurrentDirectoryA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc SetStdHandle GetCurrentDirectoryW DeleteFileW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapAlloc HeapFree GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle GetDriveTypeW CreateFileW ExitProcess LoadLibraryExW FreeLibrary RaiseException InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW WaitForSingleObjectEx EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree SetEndOfFile

user32

GetDC GetSystemMetrics ReleaseDC

gdi32

DeleteObject CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

advapi32

RegGetValueA RegSetValueExA RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExA RegEnumValueA RegCloseKey GetUserNameA LookupAccountNameA GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority

shell32

SHFileOperationA ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoInitialize CoUninitialize

wininet

InternetOpenA InternetOpenW InternetCloseHandle InternetConnectA InternetOpenUrlA InternetReadFile InternetWriteFile HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpSendRequestExA HttpEndRequestW

gdiplus

GdipSaveImageToFile GdipGetImageEncoders GdiplusStartup GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipDisposeImage GdiplusShutdown

ws2_32

inet_pton freeaddrinfo getaddrinfo WSAStartup socket send recv htons connect closesocket