_01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe
Size 449KB
Sample260604-sd9tesg19z
SHA256 01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4
MD5 3a91156c46a8b3b9a0591c9de52a8a73
SHA1 736b0424d22fc20894b24eb10a75ab90fade562f
SHA512 c4a196d898967dca3062378d741253f08e098d9e8646adb7ec1e08d1c0bc160e651be1182968e29182e46b3dc75023bc48fa3560a4d174828e1ad55ee968cf54
SSDEEP 6144:XU+OgPI8/doqtkTi1hefPW5vVWRBVyPH9BH4eKZQIc50U2MhkgVCx+n36GBdPi6E:XrOgP9lhtkVgPYBuHqUbR8+nqQBpK
TLSH
T149A46C56F65614FDE46AC07483478A22B972B8850B35BDEF02E4C6313F66AE16F3CB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe

File Explorer

_01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe

.exe 449KB

_01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4.exe

IMPHASH 39ef5e7a32947ec49e9659999128e685
SHA256 01712a5e443efb4aa43ef3f8b38a4245cb0d0c1bf13b8d3ac4207247a44f7ab4
MD5 3a91156c46a8b3b9a0591c9de52a8a73
SHA1 736b0424d22fc20894b24eb10a75ab90fade562f
SHA512 c4a196d898967dca3062378d741253f08e098d9e8646adb7ec1e08d1c0bc160e651be1182968e29182e46b3dc75023bc48fa3560a4d174828e1ad55ee968cf54
SSDEEP 6144:XU+OgPI8/doqtkTi1hefPW5vVWRBVyPH9BH4eKZQIc50U2MhkgVCx+n36GBdPi6E:XrOgP9lhtkVgPYBuHqUbR8+nqQBpK
TLSH
T149A46C56F65614FDE46AC07483478A22B972B8850B35BDEF02E4C6313F66AE16F3CB50
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

242912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlUnwindEx NtWriteFile NtQuerySystemInformation RtlGetVersion NtQueryInformationProcess RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlNtStatusToDosError RtlPcToFileHeader

advapi32

OpenSCManagerW CopySid GetLengthSid IsValidSid GetTokenInformation SystemFunction036 CloseServiceHandle RegSetValueExW RegCreateKeyW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges CreateServiceW OpenServiceW RegOpenKeyW

kernel32

GetCPInfo WideCharToMultiByte SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualQueryEx HeapFree CloseHandle GetLastError HeapReAlloc GetCurrentProcessId GetProcessHeap GetCurrentProcess HeapAlloc Sleep AcquireSRWLockExclusive ReleaseSRWLockExclusive WaitForSingleObject GetExitCodeProcess AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable GetSystemInfo GetModuleHandleA GetProcAddress GetCurrentThread TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode MultiByteToWideChar WriteConsoleW SetLastError GetModuleHandleW FormatMessageW GetEnvironmentVariableW GetModuleFileNameW GetCommandLineW CreateFileW SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileW FindClose GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx ExitProcess GetSystemTimeAsFileTime GetCurrentDirectoryW CreateMutexA WaitForSingleObjectEx LoadLibraryA ReleaseMutex AcquireSRWLockShared ReleaseSRWLockShared GetProcessTimes OpenProcess ReadProcessMemory GetOEMCP GetSystemTimes GetProcessIoCounters LocalFree GlobalMemoryStatusEx K32GetPerformanceInfo LoadLibraryExA FreeLibrary GetACP SetFilePointerEx IsValidCodePage FindNextFileW FindFirstFileExW GetConsoleOutputCP FlushFileBuffers HeapSize LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue GetCommandLineA GetModuleHandleExW FlsAlloc TerminateProcess WriteFile QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW

pdh

PdhRemoveCounter PdhCollectQueryData PdhOpenQueryA PdhCloseQuery PdhAddEnglishCounterW PdhGetFormattedCounterValue

fltlib

FilterLoad FilterSendMessage FilterConnectCommunicationPort

bcrypt

BCryptGenRandom

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo SysStringLen SysFreeString