211125-ml9whaehcn[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
211125-ml9whaehcn.bin
Size 297KB
Sample260604-qzx1msgw3p
SHA256 ade5780b02f010a91f0684089100035366af865caba9c6beb66a271ccc89f2ae
MD5 6ad73683b4747a9b8a4139d7d8e59f2a
SHA1 3c9905a81d3bbd8831324dc02c3a2074a486bf15
SHA512 3d9b7efb603cf04e08959d65ee078fa2a647fdeb0545ea32a17de28f985a8b4bf11f45644e950d73b4e651abb53ceff4bb7df9b86b03cb852a910675b95aaaa3
SSDEEP 6144:8CE4vZExsqr4aYWiC+F99UGGjpeoXN6/Tvg8vcJHemY63q1ih:8Sv4IvFkGM/XUfvcJ/Y6qU
TLSH
T19F542900B291D636F9F304B4B7AB2AAB899D5A302359D3D707D36CC919613D3BB30B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
211125-ml9whaehcn.bin

File Explorer

211125-ml9whaehcn.bin

.exe 297KB

211125-ml9whaehcn.bin

IMPHASH 11b071611470812180f7df86d32cb991
SHA256 ade5780b02f010a91f0684089100035366af865caba9c6beb66a271ccc89f2ae
MD5 6ad73683b4747a9b8a4139d7d8e59f2a
SHA1 3c9905a81d3bbd8831324dc02c3a2074a486bf15
SHA512 3d9b7efb603cf04e08959d65ee078fa2a647fdeb0545ea32a17de28f985a8b4bf11f45644e950d73b4e651abb53ceff4bb7df9b86b03cb852a910675b95aaaa3
SSDEEP 6144:8CE4vZExsqr4aYWiC+F99UGGjpeoXN6/Tvg8vcJHemY63q1ih:8Sv4IvFkGM/XUfvcJ/Y6qU
TLSH
T19F542900B291D636F9F304B4B7AB2AAB899D5A302359D3D707D36CC919613D3BB30B56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

224432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\fake.pdb

shlwapi

StrCmpIW StrCmpNIW StrStrIW StrDupW PathFindFileNameW PathFindExtensionW StrCpyNW wvnsprintfA

psapi

GetModuleFileNameExW

mpr

WNetCloseEnum WNetEnumResourceW WNetOpenEnumW

ntdll

NtQueryDirectoryFile _allshr _chkstk memcmp NtQueryVirtualMemory RtlDosPathNameToNtPathName_U wcsstr RtlUpcaseUnicodeChar ZwQueryInformationProcess _aulldiv RtlUnwind memset NtWaitForSingleObject NtCreateFile RtlTimeToTimeFields _wcslwr _stricmp _aullshr NtClose strstr _vsnprintf _alldiv _allmul _allshl memcpy

kernel32

SetErrorMode WaitForSingleObject ExitProcess GetLogicalDriveStringsW GetFileAttributesW SetFileAttributesW CreateFileW CreateFileMappingW GetCommandLineW GetDriveTypeW Wow64DisableWow64FsRedirection AllocConsole MoveFileW ExpandEnvironmentStringsW CreateFileMappingA QueryPerformanceFrequency HeapAlloc GetCommandLineA WaitForMultipleObjects Process32NextW Process32FirstW CreateToolhelp32Snapshot TerminateProcess OpenProcess GetLocalTime GetComputerNameW GetSystemTime GetProcAddress GlobalMemoryStatus LocalAlloc GetProcessHeap GetProcessTimes GetProcessWorkingSetSize GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetThreadTimes GetLastError SetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetTickCount LoadLibraryA GetStartupInfoW QueryPerformanceCounter LocalFree GetStdHandle WriteFile FlushFileBuffers lstrlenA OutputDebugStringA HeapFree CreateThread ExitThread TerminateThread DeleteCriticalSection Sleep CloseHandle lstrcpyW lstrcatW TlsAlloc TlsSetValue GetFileSize GetFileSizeEx ReadFile SetEndOfFile SetFilePointer SetFilePointerEx GetFileTime SetFileTime MapViewOfFile UnmapViewOfFile TlsGetValue AttachConsole

user32

wsprintfA GetDesktopWindow GetCaretPos GetCursorPos GetCapture GetQueueStatus GetFocus GetActiveWindow GetOpenClipboardWindow GetClipboardViewer GetClipboardOwner GetMessageTime GetProcessWindowStation GetMessagePos GetInputState

advapi32

CryptAcquireContextW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CryptReleaseContext CryptGenRandom