x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe
Size 313KB
Sample260528-a63ayact2j
SHA256 544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb
MD5 43e3636e47bc3da6a524f36ec498f8d1
SHA1 721baf952b7c2b9c40b62d9baf2594725c92be9a
SHA512 737e1288e68b6a048a77d920e9d738954e770f3d69c0329a3d0c632ef5adc5bc036bc75731d120870ff28e0f42a4ac19538ff55feb47c855c85c342df9e33bf8
SSDEEP 3072:yJahzAAsEu0DNR9MpN2OHv9liz5QFfALNUfBZ62Ouu4MzEPFgpeP1km5uSq9kstl:fzAAI0qHcLNaBZt5IGIvBs3qTc
TLSH
T156648E05F3A508F9F977C63CC9528906EA71BC5647A0E6DF03A04A961F237D09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe

File Explorer

x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe

.exe 313KB

x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe

IMPHASH d1da327d0afac7e6b29e904e1acd8b8b
SHA256 544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb
MD5 43e3636e47bc3da6a524f36ec498f8d1
SHA1 721baf952b7c2b9c40b62d9baf2594725c92be9a
SHA512 737e1288e68b6a048a77d920e9d738954e770f3d69c0329a3d0c632ef5adc5bc036bc75731d120870ff28e0f42a4ac19538ff55feb47c855c85c342df9e33bf8
SSDEEP 3072:yJahzAAsEu0DNR9MpN2OHv9liz5QFfALNUfBZ62Ouu4MzEPFgpeP1km5uSq9kstl:fzAAI0qHcLNaBZt5IGIvBs3qTc
TLSH
T156648E05F3A508F9F977C63CC9528906EA71BC5647A0E6DF03A04A961F237D09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51012

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess GetCurrentProcessId TerminateProcess CreateThread CreateProcessA OpenProcess FreeLibrary GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA Sleep lstrlenA CopyFileW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Process32First Process32Next K32EnumDeviceDrivers K32GetDeviceDriverBaseNameA WriteConsoleW DeviceIoControl GetProcessHeap HeapFree HeapAlloc GetLastError CloseHandle GetTempPathA WriteFile SetFilePointer SetFileAttributesW SetFileAttributesA ReadFile GetFileSize DeleteFileA CreateFileA CreateDirectoryW lstrcmpiA ExpandEnvironmentStringsW CreateFileW HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle ExitProcess GetModuleHandleExW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc RtlUnwind

advapi32

OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle RegDeleteTreeA RegSetValueExW RegSetValueExA RegOpenKeyExW RegCreateKeyExA RegCloseKey LookupPrivilegeValueA DuplicateTokenEx AdjustTokenPrivileges CreateProcessAsUserA OpenProcessToken

ws2_32

WSAStartup

winhttp

WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shlwapi

PathFileExistsA

Name

.text

Size

178KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

x544c7dd3546378c5ce1ebfe873ca95e5c9f1bb6dcb17b0f9f628fb835473a4cb.exe

kernel32

advapi32

ws2_32

winhttp

userenv

shlwapi

generic