4ec852b2-4156-4c9a-8cf0-79436fc37c28_17711577-b666-4cb5-8f4d-2efad5d43390_notepad[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4ec852b2-4156-4c9a-8cf0-79436fc37c28_17711577-b666-4cb5-8f4d-2efad5d43390_notepad.exe
Size 196KB
Sample260628-2twfeagw8m
SHA256 da5807bb0997cc6b5132950ec87eda2b33b1ac4533cf1f7a22a6f3b576ed7c5b
MD5 6f51bcabf1b2b34ad7e670aee6da451f
SHA1 f3a517b07528cee3a7399386c58a9c7a59aa96b3
SHA512 d1f17b4cb49eede2e999147335661bed43425b6fafca030cf4b24e7535bbee9bfd3ff737f8d3df7a71d6496d09866d5f64e206ed49ab4d61c17507a7c9b8d461
SSDEEP 6144:K6AEtLJt67jvh/gKEvP0iEywX//kDGSTrX7:HAyo7SKE3FEywX//kR/X
TLSH
T13814396D22EE10E5E47B917CC8424246E2B27431272262EF15E0C57C9F27AEDBA7CF51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ec852b2-4156-4c9a-8cf0-79436fc37c28_17711577-b666-4cb5-8f4d-2efad5d43390_notepad.exe

File Explorer

4ec852b2-4156-4c9a-8cf0-79436fc37c28_17711577-b666-4cb5-8f4d-2efad5d43390_notepad.exe

.exe 196KB

4ec852b2-4156-4c9a-8cf0-79436fc37c28_17711577-b666-4cb5-8f4d-2efad5d43390_notepad.exe

IMPHASH 09ed737a03db7295bf734a9953f6eb5e
SHA256 da5807bb0997cc6b5132950ec87eda2b33b1ac4533cf1f7a22a6f3b576ed7c5b
MD5 6f51bcabf1b2b34ad7e670aee6da451f
SHA1 f3a517b07528cee3a7399386c58a9c7a59aa96b3
SHA512 d1f17b4cb49eede2e999147335661bed43425b6fafca030cf4b24e7535bbee9bfd3ff737f8d3df7a71d6496d09866d5f64e206ed49ab4d61c17507a7c9b8d461
SSDEEP 6144:K6AEtLJt67jvh/gKEvP0iEywX//kDGSTrX7:HAyo7SKE3FEywX//kR/X
TLSH
T13814396D22EE10E5E47B917CC8424246E2B27431272262EF15E0C57C9F27AEDBA7CF51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

notepad.pdb

kernel32

GetProcAddress CreateMutexExW AcquireSRWLockShared DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW DebugBreak IsDebuggerPresent GlobalFree GetLocaleInfoW CreateFileW ReadFile GetACP MulDiv GetCurrentProcess GetCommandLineW HeapSetInformation FreeLibrary LocalFree LocalAlloc FindFirstFileW FindClose FoldStringW GetModuleFileNameW GetUserDefaultUILanguage HeapFree HeapAlloc GetTimeFormatW WideCharToMultiByte WriteFile GetFileAttributesW LocalLock LocalUnlock DeleteFileW SetEndOfFile GetFileAttributesExW GetFileInformationByHandle CreateFileMappingW MapViewOfFile MultiByteToWideChar LocalReAlloc UnmapViewOfFile GetFullPathNameW LocalSize GetStartupInfoW lstrcmpiW FindNLSString GlobalLock GlobalUnlock GlobalAlloc GetDiskFreeSpaceExW CreateDirectoryW RegisterApplicationRestart CreateSemaphoreExW CreateThreadpoolTimer ReleaseSRWLockShared SetThreadpoolTimer CloseHandle OpenSemaphoreW WaitForSingleObjectEx AcquireSRWLockExclusive CloseThreadpoolTimer OutputDebugStringW ReleaseSRWLockExclusive GetLastError FormatMessageW ReleaseMutex GetCurrentThreadId WaitForSingleObject WaitForThreadpoolTimerCallbacks InitializeCriticalSectionEx LeaveCriticalSection GetModuleHandleExW ReleaseSemaphore EnterCriticalSection GetDateFormatW SetLastError GetLocalTime ResolveDelayLoadedAPI DelayLoadFailureHook GetModuleFileNameA

gdi32

CreateDCW StartPage StartDocW SetAbortProc DeleteDC EndDoc AbortDoc EndPage GetTextMetricsW SetBkMode LPtoDP SetWindowExtEx SetViewportExtEx SetMapMode GetTextExtentPoint32W TextOutW EnumFontsW GetTextFaceW SelectObject DeleteObject CreateFontIndirectW GetDeviceCaps

user32

PostMessageW MessageBoxW GetMenu CheckMenuItem GetSubMenu EnableMenuItem ShowWindow GetDC ReleaseDC SetCursor GetDpiForWindow SetActiveWindow LoadStringW DefWindowProcW IsIconic SetFocus PostQuitMessage DestroyWindow MessageBeep GetForegroundWindow GetDlgCtrlID SetWindowPos RedrawWindow GetKeyboardLayout CharNextW SetWinEventHook GetMessageW TranslateAcceleratorW IsDialogMessageW TranslateMessage DispatchMessageW UnhookWinEvent SetWindowTextW OpenClipboard IsClipboardFormatAvailable CloseClipboard SetDlgItemTextW GetDlgItemTextW EndDialog SendDlgItemMessageW SetScrollPos InvalidateRect UpdateWindow GetWindowPlacement SetWindowPlacement CharUpperW GetSystemMenu LoadAcceleratorsW SetWindowLongW CreateWindowExW MonitorFromWindow RegisterWindowMessageW LoadCursorW RegisterClassExW GetWindowTextLengthW GetWindowLongW PeekMessageW GetWindowTextW EnableWindow CreateDialogParamW DrawTextExW LoadIconW LoadImageW DialogBoxParamW SetThreadDpiAwarenessContext SendMessageW MoveWindow GetClientRect GetFocus

api-ms-win-crt-string-l1-1-0

memset wcsnlen wcscmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh _o__cexit _o__configthreadlocale _o__configure_wide_argv _o__crt_atexit _o__errno _o__exit _o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o__wtol _o_exit _o_free _o_iswdigit _o_malloc _o_terminate _o_toupper __CxxFrameHandler3 _CxxThrowException _o___std_exception_destroy _o___std_exception_copy _o___p__commode _o___stdio_common_vswprintf __C_specific_handler memcmp memcpy memmove

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles CoUninitialize PropVariantClear CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoCreateInstance CoInitializeEx CoCreateGuid

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsFileSpecW PathFindExtensionW PathFileExistsW

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shcore-path-l1-1-0

ord170

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateStringReference

api-ms-win-core-synch-l1-1-0

SetEvent CreateEventExW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled

api-ms-win-core-synch-l1-2-0

Sleep

comctl32

CreateStatusWindowW ord345

Name

.text

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

728B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4ec852b2-4156-4c9a-8cf0-79436fc37c28_17711577-b666-4cb5-8f4d-2efad5d43390_notepad.exe

kernel32

gdi32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shcore-path-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

comctl32

generic