52f5o3tf[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
52f5o3tf.exe
Size 276KB
Sample260622-kwpbfaa18y
SHA256 1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22
MD5 e49835aaf0e4fb90e667996257d9cb3b
SHA1 ae27b380f903c76c951367ae5d4a84e4710d6754
SHA512 79bc6b32dfe18991378728dc399efa8e3cf4c426c3815821508aa71fc4b65c1171be1c4d3e3202202a124c214817f5678ead6fa065a084bdd05b6801ee02264e
SSDEEP 6144:pxhixu3VMA5F/GkUTmS4SXPY1pP3+b5YFYABS5:p/ixUZjGk4BS1JK5r
TLSH
T17654AE09F6A908FAF577C575C9520902EB737C8647B0D7EF0B9049968E136E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52f5o3tf.exe

File Explorer

52f5o3tf.exe

.exe 276KB

52f5o3tf.exe

IMPHASH def9fed52c585959ce502a13019229e0
SHA256 1bc4bfd72b3b21e446266e65a55b2ba0857d0ad37280696e7b147adfa3706d22
MD5 e49835aaf0e4fb90e667996257d9cb3b
SHA1 ae27b380f903c76c951367ae5d4a84e4710d6754
SHA512 79bc6b32dfe18991378728dc399efa8e3cf4c426c3815821508aa71fc4b65c1171be1c4d3e3202202a124c214817f5678ead6fa065a084bdd05b6801ee02264e
SSDEEP 6144:pxhixu3VMA5F/GkUTmS4SXPY1pP3+b5YFYABS5:p/ixUZjGk4BS1JK5r
TLSH
T17654AE09F6A908FAF577C575C9520902EB737C8647B0D7EF0B9049968E136E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42828

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptEncrypt

advapi32

RegSetValueExW RegOpenKeyExW CryptGetHashParam RegCloseKey CryptAcquireContextW RegCreateKeyExW CryptCreateHash CryptHashData CryptReleaseContext CryptDestroyHash

shell32

ShellExecuteW SHGetFolderPathW ShellExecuteExW

iphlpapi

GetAdaptersInfo

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCallClassInstaller SetupDiDestroyDeviceInfoList

kernel32

WriteConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW SetEnvironmentVariableW CreateProcessW GetExitCodeProcess WaitForSingleObject GetFileType CreateDirectoryW ReadFile GetLogicalDrives GetCurrentProcess WriteFile GetModuleFileNameW CreateFileW SetFileAttributesW GetTickCount64 DeleteFileW CloseHandle SetFilePointerEx GetFileSize ExitProcess GlobalMemoryStatusEx CopyFileW MoveFileW GetDriveTypeW IsDebuggerPresent FlushFileBuffers WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId GetLastError WaitForSingleObjectEx GetExitCodeThread GetLogicalProcessorInformationEx LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter GetSystemTimePreciseAsFileTime GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP GetProcessHeap RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCPInfo GetStdHandle TerminateProcess GetCommandLineA GetCommandLineW UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW SetStdHandle

ntdll

RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RtlVirtualUnwind

Name

.text

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

52f5o3tf.exe

bcrypt

advapi32

shell32

iphlpapi

setupapi

kernel32

ntdll

generic