STEM Egypt 27[.]exe

General

Target
STEM Egypt 27.exe
Size 1.0MB
Sample260626-s75fssds2l
SHA256 8fc4fb4e87e4b50633fbb7e63d677299989b9f867f1885fe2b7fb3244a35fe9f
MD5 ad4e62ca4fd91966e4da08c8a9c8e6af
SHA1 33ff51c9b1ba2dc62a3bc55a46254527ee5f4cc1
SHA512 af99772ef6c03fb412ebec2bbbbb0b6cb42b19585c56cf00d755c9caeb30ef938ae9a03d17bd78084a4c47354932c6a52f265443069ada2c7be19ea22849d591
SSDEEP 24576:X1pgqFtqFYQadK3B5maZnf6jf60GsDASLTa/:X4+t+YlK3B3f2SYAqa
TLSH
T17E35D042B55054D6E827A0B4880FD51023547EEE626DD75E33D2FB6E5AE3372882BF83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
STEM Egypt 27.exe

File Explorer

STEM Egypt 27.exe

.exe 1.0MB

STEM Egypt 27.exe

IMPHASH ba7d96d84ab7b1beb0992226d146c4c7
SHA256 8fc4fb4e87e4b50633fbb7e63d677299989b9f867f1885fe2b7fb3244a35fe9f
MD5 ad4e62ca4fd91966e4da08c8a9c8e6af
SHA1 33ff51c9b1ba2dc62a3bc55a46254527ee5f4cc1
SHA512 af99772ef6c03fb412ebec2bbbbb0b6cb42b19585c56cf00d755c9caeb30ef938ae9a03d17bd78084a4c47354932c6a52f265443069ada2c7be19ea22849d591
SSDEEP 24576:X1pgqFtqFYQadK3B5maZnf6jf60GsDASLTa/:X4+t+YlK3B3f2SYAqa
TLSH
T17E35D042B55054D6E827A0B4880FD51023547EEE626DD75E33D2FB6E5AE3372882BF83
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\E\Mohammed\Mohammed VB\STEM vb.2019\STEM\.App complete\C++\Dount caver c++\Dount caver c++ n5 +100 n8\Dount caver\x64\Release\Dount.pdb

kernel32

CloseHandle LoadResource FindResourceW GetFileSize LockResource CreateFileMappingW MapViewOfFile WriteConsoleW SetFilePointerEx GetLastError UnmapViewOfFile CreateFileW CreateMutexW VirtualAlloc VirtualFree VirtualProtect SizeofResource SetEnvironmentVariableA ReadFile GetConsoleMode InitOnceComplete InitOnceBeginInitialize RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP

user32

MessageBoxW

advapi32

CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptCreateHash CryptDeriveKey CryptHashData CryptDestroyHash CryptSetKeyParam CryptReleaseContext

shell32

SHGetFolderPathW

Name

.text

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

956KB

Virtual Size

956KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

STEM Egypt 27.exe

kernel32

user32

advapi32

shell32

generic