MOTIF_e766e048bd222cfd2b9cc1bf24125dac_refanged[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MOTIF_e766e048bd222cfd2b9cc1bf24125dac_refanged.exe
Size 191KB
Sample260626-ppbh8abv2w
SHA256 1289ee3d29967f491542c0bdeff6974aad6b37932e91ff9c746fb220d5edb407
MD5 e766e048bd222cfd2b9cc1bf24125dac
SHA1 8f4f0edd5fb3737914180ff28ed0e9cca25bf4cc
SHA512 c2657df4c2a6f37df55e90897a4efc52f0d0688d280433160b0b3fe948cdbdd0a833d38273c6526cde61d7fde447396bb4a59a5c5c67837a3614915bacfcbaad
SSDEEP 3072:hDEf60zjuvCD9iHR0C/QtuF+9cGvE3T3BfIFjGoswdH2XIm95aS58+arhx54ew7:ho3zKqcxro4F+NvTjJd2Im95a08dxe
TLSH
T162144B316305C9BAE19318B540E99BBB582CA536173F60C7FBC81D7E9B989C0A63534F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MOTIF_e766e048bd222cfd2b9cc1bf24125dac_refanged.exe

File Explorer

MOTIF_e766e048bd222cfd2b9cc1bf24125dac_refanged.exe

.exe 191KB

MOTIF_e766e048bd222cfd2b9cc1bf24125dac_refanged.exe

IMPHASH c5e424f906a62f2082c9e653d8c2a7f9
SHA256 1289ee3d29967f491542c0bdeff6974aad6b37932e91ff9c746fb220d5edb407
MD5 e766e048bd222cfd2b9cc1bf24125dac
SHA1 8f4f0edd5fb3737914180ff28ed0e9cca25bf4cc
SHA512 c2657df4c2a6f37df55e90897a4efc52f0d0688d280433160b0b3fe948cdbdd0a833d38273c6526cde61d7fde447396bb4a59a5c5c67837a3614915bacfcbaad
SSDEEP 3072:hDEf60zjuvCD9iHR0C/QtuF+9cGvE3T3BfIFjGoswdH2XIm95aS58+arhx54ew7:ho3zKqcxro4F+NvTjJd2Im95a08dxe
TLSH
T162144B316305C9BAE19318B540E99BBB582CA536173F60C7FBC81D7E9B989C0A63534F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\John\Documents\Новая папка\XAPS_OBJECTIVE\Release\XAPS_OBJECTIVE.pdb

kernel32

Sleep FindClose FindNextFileA FindFirstFileA RemoveDirectoryA DeleteFileA SetFileAttributesA CreateDirectoryA WriteFile WideCharToMultiByte GetCommandLineW GetVersionExW GetDriveTypeA GetExitCodeThread WaitForSingleObject WriteConsoleW SetStdHandle SetEnvironmentVariableA CompareStringW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer CreateProcessA GetExitCodeProcess CreateFileA GetLastError CloseHandle GetFileSize TerminateThread ReadFile GetStringTypeW HeapReAlloc GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetFileAttributesA MultiByteToWideChar LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo LoadLibraryW DeleteCriticalSection InitializeCriticalSectionAndSpinCount HeapSize LeaveCriticalSection EnterCriticalSection GetModuleFileNameW GetStdHandle HeapCreate InterlockedDecrement CreateFileW GetSystemTimeAsFileTime HeapFree HeapAlloc RtlUnwind RaiseException EncodePointer DecodePointer GetProcAddress GetModuleHandleW ExitProcess ExitThread GetCurrentThreadId CreateThread GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError

user32

SendMessageW keybd_event GetDC GetSystemMetrics SetCursorPos mouse_event GetForegroundWindow GetWindowThreadProcessId GetKeyboardLayout VkKeyScanW

gdi32

CreateCompatibleBitmap SelectObject BitBlt DeleteObject CreateCompatibleDC

shell32

ord68 CommandLineToArgvW

ole32

CreateStreamOnHGlobal

gdiplus

GdipGetImageEncodersSize GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipDisposeImage GdipCloneImage GdipSaveImageToStream GdipCreateBitmapFromHBITMAP

ws2_32

send recv select gethostbyname __WSAFDIsSet accept ioctlsocket listen htons connect getsockname bind socket inet_addr closesocket WSAStartup WSAGetLastError recvfrom sendto

shlwapi

PathIsDirectoryA