59f3fdf16a7db80031ab151abc1c881a94ec26312b741579c2ed0cc4c0e501fe[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
59f3fdf16a7db80031ab151abc1c881a94ec26312b741579c2ed0cc4c0e501fe.exe
Size 2.2MB
Sample260324-25vm9agx4x
SHA256 59f3fdf16a7db80031ab151abc1c881a94ec26312b741579c2ed0cc4c0e501fe
MD5 5696f3df9849f7349101dd7b69bec996
SHA1 2275eec26549c453b01974e31d7da60d6ea60bff
SHA512 3a566066c2770bced45973b1ae6db8580eb44642d3effda0d232e10a330f91e40f87a1e198d9c3296cfae9d4bd3159862f89d0ade0be015056eaa7ccf72f729d
SSDEEP 49152:MAoUkI4ujKeT/ZvTDrgjBqmu2mERE8B/iPGaumcw/hagIei1GXaqAlOi8:efujKeT/ZvTfuDRE8B+GhmcCIeAUaqAC
TLSH
T19AB5E0117796C039E6B226B09929AB96453EBC717F76CDCB23C0796D88306D25E30B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59f3fdf16a7db80031ab151abc1c881a94ec26312b741579c2ed0cc4c0e501fe.exe

File Explorer

59f3fdf16a7db80031ab151abc1c881a94ec26312b741579c2ed0cc4c0e501fe.exe

.exe 2.2MB

59f3fdf16a7db80031ab151abc1c881a94ec26312b741579c2ed0cc4c0e501fe.exe

IMPHASH 5a99d03856ee9c5125ee42feee942527
SHA256 59f3fdf16a7db80031ab151abc1c881a94ec26312b741579c2ed0cc4c0e501fe
MD5 5696f3df9849f7349101dd7b69bec996
SHA1 2275eec26549c453b01974e31d7da60d6ea60bff
SHA512 3a566066c2770bced45973b1ae6db8580eb44642d3effda0d232e10a330f91e40f87a1e198d9c3296cfae9d4bd3159862f89d0ade0be015056eaa7ccf72f729d
SSDEEP 49152:MAoUkI4ujKeT/ZvTDrgjBqmu2mERE8B/iPGaumcw/hagIei1GXaqAlOi8:efujKeT/ZvTfuDRE8B+GhmcCIeAUaqAC
TLSH
T19AB5E0117796C039E6B226B09929AB96453EBC717F76CDCB23C0796D88306D25E30B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

335443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wevtapi

EvtNext EvtClose EvtSubscribe EvtCreateRenderContext EvtRender

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

kernel32

CreateMutexW OpenEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId CreateProcessW OpenProcess GetTickCount GetTickCount64 FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW lstrcmpiW QueryFullProcessImageNameW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW LoadLibraryW ResetEvent CreateEventW LCMapStringEx GetVersionExW IsWow64Process LocalFree OpenMutexW GetProcessTimes ProcessIdToSessionId GetSystemTimeAsFileTime GetWindowsDirectoryW OpenFileMappingW MapViewOfFile UnmapViewOfFile LocaleNameToLCID SetThreadUILanguage GetThreadUILanguage WaitForMultipleObjectsEx CreateFileMappingW DebugBreak ReleaseSemaphore WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetModuleFileNameA GetModuleHandleExW WideCharToMultiByte ExpandEnvironmentStringsW FindFirstChangeNotificationW FindNextChangeNotification GetFileSizeEx GetFileTime MulDiv lstrcmpW SetEnvironmentVariableW GetFileAttributesW GetFileSize SetEndOfFile SetFilePointer WakeAllConditionVariable TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter HeapReAlloc WaitForSingleObject GetStringTypeW QueryPerformanceCounter TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SleepConditionVariableSRW EncodePointer GetStartupInfoW RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA GetCommandLineW ExitProcess GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree ReleaseMutex HeapAlloc SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapDestroy RaiseException DecodePointer ReadFile FindCloseChangeNotification DeleteFileW WritePrivateProfileStringW GetPrivateProfileStringW FormatMessageW GetCurrentThreadId SetLastError GetLastError CloseHandle IsDebuggerPresent WriteFile CreateFileW OutputDebugStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetCPInfo WriteConsoleW VirtualProtect EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW

user32

GetWindowTextLengthW GetWindowTextW DrawTextW EnumWindows IsIconic MonitorFromWindow SystemParametersInfoW LoadImageW GetWindow GetDesktopWindow FillRect GetSysColorBrush GetSysColor SetCursor SetWindowTextW RedrawWindow ReleaseDC GetDlgCtrlID SetDlgItemTextW GetDlgItem IsWindow ChangeWindowMessageFilterEx GetMonitorInfoW MonitorFromPoint IsDialogMessageW GetLastActivePopup GetCursorPos SetForegroundWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu KillTimer SetTimer MsgWaitForMultipleObjectsEx CreateDialogParamW ShowWindow CallWindowProcW PostQuitMessage DefWindowProcW SendMessageW UnregisterHotKey RegisterHotKey RegisterWindowMessageW GetClassNameW EnumChildWindows GetParent GetWindowLongW MapWindowPoints GetWindowRect GetClientRect InvalidateRect GetDC SetWindowPos LoadStringW DestroyIcon LoadCursorW GetWindowThreadProcessId FindWindowW SetWindowLongW MessageBoxW MessageBoxA AllowSetForegroundWindow GetSystemMetrics EnableWindow CharNextW DestroyWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW PostMessageW PeekMessageW DispatchMessageW TranslateMessage GetMessageW SetUserObjectInformationW IsWindowVisible

gdi32

SelectObject DeleteObject CreatePen CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps DeleteDC Polygon

advapi32

FreeSid RegFlushKey StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupPrivilegeValueW RegCloseKey CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegDeleteValueW RegCreateKeyExW

shell32

Shell_NotifyIconW SHQueryUserNotificationState ShellExecuteW SetCurrentProcessExplicitAppUserModelID

ole32

CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoInitialize StringFromGUID2 CoUninitialize CoTaskMemAlloc CoCreateGuid IIDFromString

oleaut32

VariantClear VariantInit SysAllocString VarUI4FromStr SysFreeString VarI4FromStr VarR8FromStr VarDateFromStr VarDecFromStr VarDecCmp

comctl32

ord381 ord345

uxtheme

SetWindowTheme

winhttp

WinHttpOpen WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpConnect WinHttpSendRequest WinHttpWriteData WinHttpReadData WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpenRequest WinHttpSetOption WinHttpAddRequestHeaders WinHttpSetCredentials

Name

.text

Size

483KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

677KB

Virtual Size

680KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

59f3fdf16a7db80031ab151abc1c881a94ec26312b741579c2ed0cc4c0e501fe.exe

userenv

wevtapi

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

uxtheme

winhttp

generic