FORCED_EMBED[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FORCED_EMBED.exe
Size 304KB
Sample260601-sg5zmsgx6v
SHA256 bc5c4bd667070e5c45660a68d0fe4ac74c1132cde6d8dc3e4192e3fdf132232d
MD5 bcc0f297176e135839f5e02861b6461f
SHA1 1a1e9c98cb368be90e531df255240272fd584ddd
SHA512 20ee74f7f4c6de84a7d92b5cb9240d522597b16e529c9ced4d9f86f4e079bedd742876b7d74b76354c090dbda5b1356ed564b633a49b6e6db63d3d08f384ceb0
SSDEEP 6144:8pej2opRvhE7RcX7gMCqj28QXH4g93i9LiNOrcHQ1OF:8Do0YEMCqj2ZXH4t6AD1
TLSH
T1BA646C07B69595BCE256C038934696B3B633F88A06307DFF12E496303F59E916F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FORCED_EMBED.exe

File Explorer

FORCED_EMBED.exe

.exe 304KB

FORCED_EMBED.exe

IMPHASH 15e107a91ba387d18c04a87f373c6605
SHA256 bc5c4bd667070e5c45660a68d0fe4ac74c1132cde6d8dc3e4192e3fdf132232d
MD5 bcc0f297176e135839f5e02861b6461f
SHA1 1a1e9c98cb368be90e531df255240272fd584ddd
SHA512 20ee74f7f4c6de84a7d92b5cb9240d522597b16e529c9ced4d9f86f4e079bedd742876b7d74b76354c090dbda5b1356ed564b633a49b6e6db63d3d08f384ceb0
SSDEEP 6144:8pej2opRvhE7RcX7gMCqj28QXH4g93i9LiNOrcHQ1OF:8Do0YEMCqj2ZXH4t6AD1
TLSH
T1BA646C07B69595BCE256C038934696B3B633F88A06307DFF12E496303F59E916F2CB19
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW WriteFileEx __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm abort atexit calloc exit fflush fprintf free malloc memcmp memcpy memmove memset setvbuf signal strlen strncmp vfprintf

ntdll

NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlNtStatusToDosError

Name

.text

Size

244KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FORCED_EMBED.exe

api-ms-win-core-synch-l1-2-0

kernel32

msvcrt

ntdll

generic