file_cf7313a869b75634[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
file_cf7313a869b75634.exe
Size 8.1MB
Sample260626-phnvzabs91
SHA256 576f3ff7e34e66f6298efbb5b9ccda4d2c27adeb9040ba9c85012c9f555f2d4f
MD5 3fc4a02f1bbb142af490bb2d0d046cdf
SHA1 c8ade7c35ea5723eeef0d517fbbda2e8847f6479
SHA512 acc259439cc922ee4ce9310b8124302fd7510b1db5bcb9cb1d4879e888364e7c4ae495376e88085a4cfc12d4778aa1ee48c993ff49fb526c85f597acaa2b1fd8
SSDEEP 196608:N2ZxifyYl4j7L+iwJ7/8aRYJ+YVttiq6fIF8+SJDMIFgW:mx+Xl07twJ7/LY58TIF8+SpMA
TLSH
T13E863302717614F8E66BC138D3499B529B36309D0F364EFF225516282F36BE92D39F98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file_cf7313a869b75634.exe

File Explorer

file_cf7313a869b75634.exe

.exe 8.1MB

file_cf7313a869b75634.exe

IMPHASH 532cc1f671bb30c461b49580820593c1
SHA256 576f3ff7e34e66f6298efbb5b9ccda4d2c27adeb9040ba9c85012c9f555f2d4f
MD5 3fc4a02f1bbb142af490bb2d0d046cdf
SHA1 c8ade7c35ea5723eeef0d517fbbda2e8847f6479
SHA512 acc259439cc922ee4ce9310b8124302fd7510b1db5bcb9cb1d4879e888364e7c4ae495376e88085a4cfc12d4778aa1ee48c993ff49fb526c85f597acaa2b1fd8
SSDEEP 196608:N2ZxifyYl4j7L+iwJ7/8aRYJ+YVttiq6fIF8+SJDMIFgW:mx+Xl07twJ7/LY58TIF8+SpMA
TLSH
T13E863302717614F8E66BC138D3499B529B36309D0F364EFF225516282F36BE92D39F98
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

111044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rpcbroker.pdb

ole32

CoGetObject StringFromGUID2 CoUninitialize CoCreateInstance CoInitializeEx

ntdll

RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlNtStatusToDosError NtWriteFile RtlReleasePebLock RtlInitUnicodeString RtlAcquirePebLock RtlPcToFileHeader

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

OpenProcessToken GetUserNameA GetTokenInformation

kernel32

SetFilePointerEx LCMapStringW CompareStringW FlushFileBuffers GetStringTypeW GetFileType SetStdHandle CreateFileW SetWaitableTimer GetProcessHeap HeapFree HeapReAlloc GetCurrentProcessId GetTickCount VirtualAlloc VirtualProtect VirtualFree GetSystemTimeAsFileTime GetModuleFileNameW GetCurrentProcess CloseHandle GetModuleFileNameA MultiByteToWideChar CopyFileW GetTickCount64 QueryPerformanceCounter GetLastError lstrlenW GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetModuleHandleW FormatMessageW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCurrentThreadId GetModuleHandleA ExitProcess QueryPerformanceFrequency HeapAlloc WriteConsoleW GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject CreateWaitableTimerExW SetEnvironmentVariableW Sleep CreateThread FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose HeapSize

oleaut32

SysFreeString SysAllocString

shell32

SHGetFolderPathW