420-services[.]exe

Resubmissions

23/06/2026, 10:34

260623-ml5lsabz5p3

23/06/2026, 10:31

260623-mkcvdabz4r8

23/06/2026, 10:29

260623-mjfvmsbz4l3

Sharing

Copy URL Twitter E-mail

General

Target
420-services.exe
Size 2.1MB
Sample260623-ml5lsabz5p
SHA256 fb39a70fdb48265c5109dc9ca4a3b864d49769c567687e4bee061c5bff75b8cc
MD5 6f40f94c9657bcd7e5d4f0b71904a9bf
SHA1 52c1535926313f3a962034f702125b32d10f7973
SHA512 22ab4e139a6dd02202ef5879a895ee5844b78897b308f7a9189b9f0057df35cb3d74961844a3bcb4da65c849333bcdf14aa4c00d5e564d4101965e96d00daab9
SSDEEP 49152:8mZdj0onwG4ugq1NTxoPCdIA1sITLl3oKJ6mEO2ls:ZbXxo
TLSH
T178A5AEEA731C23D8C45B85388623AD03F6757829037486DFB7EEE5957B8B5804E76B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
420-services.exe

File Explorer

420-services.exe

.exe 2.1MB

420-services.exe

IMPHASH d4487b739bcc840725c40f6c34a2596f
SHA256 fb39a70fdb48265c5109dc9ca4a3b864d49769c567687e4bee061c5bff75b8cc
MD5 6f40f94c9657bcd7e5d4f0b71904a9bf
SHA1 52c1535926313f3a962034f702125b32d10f7973
SHA512 22ab4e139a6dd02202ef5879a895ee5844b78897b308f7a9189b9f0057df35cb3d74961844a3bcb4da65c849333bcdf14aa4c00d5e564d4101965e96d00daab9
SSDEEP 49152:8mZdj0onwG4ugq1NTxoPCdIA1sITLl3oKJ6mEO2ls:ZbXxo
TLSH
T178A5AEEA731C23D8C45B85388623AD03F6757829037486DFB7EEE5957B8B5804E76B02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

465888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

advapi32

SetEntriesInAclW CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW RevertToSelf GetTokenInformation PrivilegeCheck SetTokenInformation RegEnumValueW QueryServiceStatusEx OpenServiceW RegDeleteValueW RegOpenKeyExW InitializeSecurityDescriptor FreeSid OpenProcessToken RegSetKeySecurity RegEnumKeyExW SetThreadToken AllocateAndInitializeSid OpenSCManagerW CloseServiceHandle RegQueryInfoKeyW RegCloseKey RegGetKeySecurity AdjustTokenPrivileges SetSecurityDescriptorDacl LookupPrivilegeValueW

d3dx9_43

D3DXCreateTextureFromFileInMemory

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

GetFileAttributesExW FindFirstFileExW FindNextFileW InitializeSListHead GetSystemTimeAsFileTime FormatMessageA FindClose AreFileApisANSI GetFileInformationByHandleEx WriteProcessMemory GetCurrentProcess WriteFile TerminateProcess GetModuleFileNameW CreatePipe SetFilePointer SetEndOfFile GetTempPathW WaitForSingleObject LocalAlloc CreateFileW GetFileAttributesW OpenProcess GetLocaleInfoEx CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW SetFileInformationByHandle DeleteFileW Process32FirstW CloseHandle GetSystemInfo GetProcAddress LocalFree MoveFileExW GetFileSize ReadProcessMemory CreateProcessW GetModuleHandleW WideCharToMultiByte GetTempFileNameW GetTickCount MoveFileW VirtualQueryEx GetCurrentProcessId GetCurrentThreadId LoadLibraryA CompareFileTime K32GetMappedFileNameA Thread32Next Thread32First SuspendThread ResumeThread GetModuleHandleA GetTickCount64 GetThreadTimes OpenThread SetConsoleTextAttribute SetConsoleTitleA GetStdHandle ExitProcess AllocConsole SetConsoleTitleW GlobalAlloc GlobalFree GlobalLock GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter GetStartupInfoW GetCommandLineW IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter IsDebuggerPresent FindFirstFileW SetFileAttributesW SetUnhandledExceptionFilter

user32

MapWindowPoints SetWindowDisplayAffinity MoveWindow DefWindowProcW SetWindowLongW SetForegroundWindow GetWindowRect ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetWindowLongW TranslateMessage GetKeyState GetClipboardData SetClipboardData GetAsyncKeyState DispatchMessageW PeekMessageW

shell32

SHGetFolderPathW ShellExecuteA

ole32

CoInitializeEx

msvcp140

_Mtx_unlock _Mtx_lock _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Xtime_get_ticks _Query_perf_counter _Thrd_sleep _Cnd_do_broadcast_at_thread_exit _Mtx_init_in_situ _Mtx_destroy_in_situ ?_Random_device@std@@YAIXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ??_7_Facet_base@std@@6B@ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7facet@locale@std@@6B@ _Strcoll ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??Bid@locale@std@@QEAA_KXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

shlwapi

PathStripPathW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy memset _CxxThrowException __C_specific_handler __current_exception_context __current_exception memchr strstr __std_exception_destroy __std_exception_copy strchr memcmp

api-ms-win-crt-stdio-l1-1-0

ungetc fsetpos __stdio_common_vsprintf_s fread fgetpos _fseeki64 __stdio_common_vsscanf _wfopen __stdio_common_vfprintf fseek _get_stream_buffer_pointers _set_fmode ftell freopen_s fwrite __acrt_iob_func __p__commode fgetc fclose fflush __stdio_common_vswprintf_s setvbuf fputc __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

_callnewh free realloc _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

wcscpy_s tolower _wcsicmp towlower strcmp

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-runtime-l1-1-0

terminate _beginthreadex exit _wsystem _c_exit _exit _initterm_e _initterm _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

ceilf sinf pow acosf cosf sqrt sqrtf __setusermatherr roundf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale