4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0[.]exe

General

Target
4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe
Size 239KB
Sample260511-msd3eaaz2r
SHA256 4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0
MD5 098873c4d1a870ee498e6c9fcdbbb461
SHA1 69f352e651021ec9ff41cd3200622992a0ea6b94
SHA512 1a5443bba32fe8212b12d812ebb87f465cf28e19e56e6774a2ff461a669fabfb7cb900fa2ae496520b51785e0b15d2e047fd6d3674ed7cf35588a6b0a34d2760
SSDEEP 6144:FEyBJtmNllRR9Bihsc5JGxIrJdrCa42gnuOG:FEyBnAMhsc5JGxurCa4c
TLSH
T1B5346B5B73E520FAE0778639C8A3094AD772B83107619BAF03A4465A1F277D19D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe

File Explorer

4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe

.exe 239KB

4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0.exe

IMPHASH f245306ad482faf631486bed55bde6ec
SHA256 4e5fe3824f95bdebdeb56b652a48aae17ba8d3317300f983f9ec1e22da22b7f0
MD5 098873c4d1a870ee498e6c9fcdbbb461
SHA1 69f352e651021ec9ff41cd3200622992a0ea6b94
SHA512 1a5443bba32fe8212b12d812ebb87f465cf28e19e56e6774a2ff461a669fabfb7cb900fa2ae496520b51785e0b15d2e047fd6d3674ed7cf35588a6b0a34d2760
SSDEEP 6144:FEyBJtmNllRR9Bihsc5JGxIrJdrCa42gnuOG:FEyBnAMhsc5JGxurCa4c
TLSH
T1B5346B5B73E520FAE0778639C8A3094AD772B83107619BAF03A4465A1F277D19D3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\IDE\源码\源码工具\Service\x64\Release\TestService.pdb

kernel32

HeapReAlloc SetFilePointerEx WriteConsoleW SetConsoleOutputCP lstrcpyW CloseHandle GetLastError Sleep CreateFileW WriteFile lstrlenW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize RtlUnwind

user32

wsprintfW

advapi32

RegDeleteValueW CreateServiceW RegCloseKey QueryServiceStatus CloseServiceHandle OpenSCManagerW RegDeleteKeyW ChangeServiceConfig2W RegCreateKeyExW RegSetValueExW StartServiceW OpenServiceW RegOpenKeyExW

Sharing