57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe
Size 1.2MB
Sample260414-e444zaft8s
SHA256 57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e
MD5 44efccc6dc37d85446f50934c8f83f04
SHA1 afb5c1739ae1fc2227164fa54a984de45adb4c87
SHA512 def1d31c0e7b8e98e117e7fca257a00624c567632dafd1c6677f53c60ff3596831c53c79d9b8e536d4da2d3a796b37ed8498caa3eb63f0292ce4c69e5e267b79
SSDEEP 24576:KxcxFP+OOobRioyJR5ezu413hJE5cxoBcujOajYoWk/:ZfzBE6xUjN
TLSH
T19B457D23B34860BEC86A0A3645B7CD54793FB76069178C1767F0492CEF695813E3AA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe

File Explorer

57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe

.exe 1.2MB

57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe

IMPHASH ca3b1af31abe1beced65a635aa0c47a3
SHA256 57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e
MD5 44efccc6dc37d85446f50934c8f83f04
SHA1 afb5c1739ae1fc2227164fa54a984de45adb4c87
SHA512 def1d31c0e7b8e98e117e7fca257a00624c567632dafd1c6677f53c60ff3596831c53c79d9b8e536d4da2d3a796b37ed8498caa3eb63f0292ce4c69e5e267b79
SSDEEP 24576:KxcxFP+OOobRioyJR5ezu413hJE5cxoBcujOajYoWk/:ZfzBE6xUjN
TLSH
T19B457D23B34860BEC86A0A3645B7CD54793FB76069178C1767F0492CEF695813E3AA4F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

903764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit GetErrorInfo

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey OpenThreadToken OpenProcessToken GetUserNameA GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority FreeSid EqualSid AllocateAndInitializeSid CryptGenRandom CryptReleaseContext CryptAcquireContextW

user32

MessageBoxA CharNextW LoadStringW PeekMessageW MsgWaitForMultipleObjects MessageBoxW GetSystemMetrics CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsDBCSLeadByteEx IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetConsoleOutputCP GetConsoleCP GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile SetFilePointer SetEndOfFile ReadFile GetFileType GetFileSize CreateFileW GetStdHandle CloseHandle LoadLibraryA TlsSetValue TlsGetValue LocalFree LocalAlloc WaitForSingleObject WaitForMultipleObjects VirtualQueryEx VirtualProtect VerSetConditionMask VerifyVersionInfoW SuspendThread SizeofResource SetThreadPriority SetLastError SetFileAttributesW SetEvent SetErrorMode ResumeThread ResetEvent ReleaseMutex QueryPerformanceFrequency QueryPerformanceCounter OpenMutexW MoveFileExW LockResource LoadResource LoadLibraryW HeapFree HeapDestroy HeapCreate HeapAlloc GetVolumeInformationW GetVersionExW GetUserDefaultLangID GetUserDefaultLCID GetThreadTimes GetThreadPriority GetThreadLocale GetSystemTimes GetSystemDefaultLangID GetSystemDefaultLCID GetProcessTimes GetLocalTime GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameA GetCPInfoExW GetCPInfo FreeResource InterlockedCompareExchange FormatMessageW FindResourceW FindNextFileW ExpandEnvironmentStringsW EnumSystemLocalesW EnumCalendarInfoW DeleteFileW CreateProcessW CreateMutexW CreateEventW

ole32

CoUninitialize CoInitialize

shell32

SHGetSpecialFolderPathW

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

netapi32

NetShareEnum NetApiBufferFree

Name

.text

Size

876KB

Virtual Size

875KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

250B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

270KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

57558bdab2008feb661e223e24dd1e437556bcab3c5f5a50cb5f0a640050ae0e.exe

oleaut32

advapi32

user32

kernel32

ole32

shell32

wsock32

netapi32

generic