x95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1[.]exe

General

Target
x95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1.exe
Size 5.2MB
Sample260602-ebfkxads8x
SHA256 95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1
MD5 f66b3148779feaac0b639c57b05e4f6d
SHA1 c92401995243abd0b48b8f377c232f602024ce3f
SHA512 0212bd9f09ddc0fd75687e97c6ac97f3f21f2e6a9b97f541f41ee08329e9dbe95c1363753800f42bb4d04249034474905ede8367bd4a61d3d9c9b7fb9a330648
SSDEEP 98304:PFReC9qccakO2BU3ZFrroMLG8PRYTq+5j+hyj9ZCKYo1toInWLvY+2weePZ4+sAU:PFl9Qb23zI+BYLDzHrtoInqY+5WADf6n
TLSH
T18C464A8907AE7435E262BF7C1CB0C6036C2396944F2885E7F9931835FD4B958E3E969C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1.exe

File Explorer

x95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1.exe

.exe 5.2MB

x95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1.exe

IMPHASH 2eee5b7533737ced75df48dd042fd94a
SHA256 95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1
MD5 f66b3148779feaac0b639c57b05e4f6d
SHA1 c92401995243abd0b48b8f377c232f602024ce3f
SHA512 0212bd9f09ddc0fd75687e97c6ac97f3f21f2e6a9b97f541f41ee08329e9dbe95c1363753800f42bb4d04249034474905ede8367bd4a61d3d9c9b7fb9a330648
SSDEEP 98304:PFReC9qccakO2BU3ZFrroMLG8PRYTq+5j+hyj9ZCKYo1toInWLvY+2weePZ4+sAU:PFl9Qb23zI+BYLDzHrtoInqY+5WADf6n
TLSH
T18C464A8907AE7435E262BF7C1CB0C6036C2396944F2885E7F9931835FD4B958E3E969C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW DeleteFileW WriteFile GetTempPathW CloseHandle Sleep GetTickCount LoadResource LockResource SizeofResource FindResourceA WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

shell32

ShellExecuteExW

Name

.text

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

x95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1.exe

kernel32

shell32

generic