_d90029e3093c6d6fe92901b362ce1f95b0b50c2bd3e068573e000f18e890d7d4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_d90029e3093c6d6fe92901b362ce1f95b0b50c2bd3e068573e000f18e890d7d4.exe
Size 133KB
Sample260623-rnalmsdv5m
SHA256 d90029e3093c6d6fe92901b362ce1f95b0b50c2bd3e068573e000f18e890d7d4
MD5 67fcbd3d193028d3ce33652f172a9d56
SHA1 218812955f6a07d6da4b79be768633b03d0c919d
SHA512 801802401a44b14bd87b3f311878c6722a90e5ede74ca12792a3cd3f82c4b78f6f1f4e5ca822406a14ed523a9b3dac19ba0401b8ad49e735fbba2145087a522a
SSDEEP 1536:98B2x0DtnWYWkIz7VsVwDO+FhgqU1ZnexXY8VlgUBeJ7RkUcr9+sFq2WJiYyxxAy:9yDtSsVNt8xXYSO5cr9+spYoWHaK8Hq
TLSH
T116D35B2AFA5950B5D2A6C5B8CA434906EFB37C55075167CF23D04EF60E27AE0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_d90029e3093c6d6fe92901b362ce1f95b0b50c2bd3e068573e000f18e890d7d4.exe

File Explorer

_d90029e3093c6d6fe92901b362ce1f95b0b50c2bd3e068573e000f18e890d7d4.exe

.exe 133KB

_d90029e3093c6d6fe92901b362ce1f95b0b50c2bd3e068573e000f18e890d7d4.exe

IMPHASH c9950edba2040842217851c9c251688b
SHA256 d90029e3093c6d6fe92901b362ce1f95b0b50c2bd3e068573e000f18e890d7d4
MD5 67fcbd3d193028d3ce33652f172a9d56
SHA1 218812955f6a07d6da4b79be768633b03d0c919d
SHA512 801802401a44b14bd87b3f311878c6722a90e5ede74ca12792a3cd3f82c4b78f6f1f4e5ca822406a14ed523a9b3dac19ba0401b8ad49e735fbba2145087a522a
SSDEEP 1536:98B2x0DtnWYWkIz7VsVwDO+FhgqU1ZnexXY8VlgUBeJ7RkUcr9+sFq2WJiYyxxAy:9yDtSsVNt8xXYSO5cr9+spYoWHaK8Hq
TLSH
T116D35B2AFA5950B5D2A6C5B8CA434906EFB37C55075167CF23D04EF60E27AE0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\0\Downloads\grabber\x64\Release\grabber.pdb

kernel32

GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetComputerNameW AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter LocalFree GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FormatMessageA

advapi32

RegCloseKey GetUserNameW RegQueryValueExW RegOpenKeyExW

msvcp140

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Strcoll ?_Syserror_map@std@@YAPEBDH@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?always_noconv@codecvt_base@std@@QEBA_NXZ

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpOpen

crypt32

CryptUnprotectData

bcrypt

BCryptSetProperty BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptDecrypt

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __current_exception_context __current_exception memset memcpy _CxxThrowException memcmp strchr __std_terminate __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-stdio-l1-1-0

fclose fgetc fputc _set_fmode fwrite fgetpos __p__commode fflush _get_stream_buffer_pointers fread fsetpos _fseeki64 ungetc setvbuf

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh realloc

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv terminate _initialize_onexit_table _register_onexit_function abort _initialize_narrow_environment _cexit _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _crt_atexit _invoke_watson

api-ms-win-crt-string-l1-1-0

isalnum

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr