f80e31f1_[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
f80e31f1_.exe
Size 867KB
Sample260623-cw7h1sat21
SHA256 d9d0358f38c29773be0f27e38f827b4985e025fcd422f7b15018ee6766b01efa
MD5 4a43ea5085614206a85863950a9ae915
SHA1 67845f2e57f31b33d72d8d0fc8d3cf86d6d05a54
SHA512 4ca624bc03d3d723ee689d881a7f8f730bd160ce7b6c4cf021c0e9bd2c8f0622e5d95b579c40a7cca1de9d885fe73cbe921947247c440f0a6b47984f0d84ab65
SSDEEP 24576:aIxNI7s5doLPJc/OzDsQAs9qripzwPtfeU:vxNI7s5doLPMfs9qripiGU
TLSH
T1FC15D005AA9182AFF031C83455774B42DF7ABC4C632049533F9CB5BBAF3A6506E6D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f80e31f1_.exe

File Explorer

f80e31f1_.exe

.exe 867KB

f80e31f1_.exe

IMPHASH a165f62f913e63193e3d31c9bc7f7652
SHA256 d9d0358f38c29773be0f27e38f827b4985e025fcd422f7b15018ee6766b01efa
MD5 4a43ea5085614206a85863950a9ae915
SHA1 67845f2e57f31b33d72d8d0fc8d3cf86d6d05a54
SHA512 4ca624bc03d3d723ee689d881a7f8f730bd160ce7b6c4cf021c0e9bd2c8f0622e5d95b579c40a7cca1de9d885fe73cbe921947247c440f0a6b47984f0d84ab65
SSDEEP 24576:aIxNI7s5doLPJc/OzDsQAs9qripzwPtfeU:vxNI7s5doLPMfs9qripiGU
TLSH
T1FC15D005AA9182AFF031C83455774B42DF7ABC4C632049533F9CB5BBAF3A6506E6D722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\app_compile\pub\bin64\Publish\QyLauncher.pdb

kernel32

K32GetProcessImageFileNameW CloseHandle GetProcAddress GetModuleHandleW GetCurrentProcess FindFirstFileW FindNextFileW FindClose CompareFileTime OutputDebugStringW HeapFree GetLastError HeapSize HeapReAlloc HeapAlloc DeleteCriticalSection GetProcessHeap WriteConsoleW CreateFileW OpenProcess GetCommandLineW WritePrivateProfileStringW InitializeCriticalSectionEx GetPrivateProfileStringW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW IsDebuggerPresent RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

user32

MessageBoxW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegDeleteTreeW

shell32

ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathCombineW

Name

.text

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

581KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f80e31f1_.exe

kernel32

user32

advapi32

shell32

shlwapi

generic