x147710284c3c42ac682ade3c8028df78279ed7cac3aa7d27542aa5cfffcd2cef[.]exe

General

Target
x147710284c3c42ac682ade3c8028df78279ed7cac3aa7d27542aa5cfffcd2cef.exe
Size 21.9MB
Sample260628-wxqrfaby4q
SHA256 147710284c3c42ac682ade3c8028df78279ed7cac3aa7d27542aa5cfffcd2cef
MD5 e9f878d8cfa5d6e200e9e803a7fcd83e
SHA1 b135fcb459842484d9916af7930a7be83e1e7440
SHA512 ecc2347afd01a20f0732b9da24441b0931586153501f37643f150c6dde262f8e42c99a4939d2e3b17226d9615a0edb9f356354de45916192bac21b11681b6047
SSDEEP 393216:9il5FiPSSnt3HmM4es6Iz1FU6snSCgRv3jUtZ9GJxrxeEh:9MFOVZBIz1FURSC1Yx1eE
TLSH
T12137331CA7A50C6DEA1BF4B11E2A0F46CF7238629B1585475300B7AA5F037F31A7D72A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
x147710284c3c42ac682ade3c8028df78279ed7cac3aa7d27542aa5cfffcd2cef.exe

File Explorer

x147710284c3c42ac682ade3c8028df78279ed7cac3aa7d27542aa5cfffcd2cef.exe

.exe 21.9MB

x147710284c3c42ac682ade3c8028df78279ed7cac3aa7d27542aa5cfffcd2cef.exe

IMPHASH 46d320915dca1dc2341fc6602ba139ee
SHA256 147710284c3c42ac682ade3c8028df78279ed7cac3aa7d27542aa5cfffcd2cef
MD5 e9f878d8cfa5d6e200e9e803a7fcd83e
SHA1 b135fcb459842484d9916af7930a7be83e1e7440
SHA512 ecc2347afd01a20f0732b9da24441b0931586153501f37643f150c6dde262f8e42c99a4939d2e3b17226d9615a0edb9f356354de45916192bac21b11681b6047
SSDEEP 393216:9il5FiPSSnt3HmM4es6Iz1FU6snSCgRv3jUtZ9GJxrxeEh:9MFOVZBIz1FURSC1Yx1eE
TLSH
T12137331CA7A50C6DEA1BF4B11E2A0F46CF7238629B1585475300B7AA5F037F31A7D72A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

kernel32

FlsFree WriteConsoleW HeapReAlloc CreateDirectoryW SetConsoleCtrlHandler AddDllDirectory GetCommandLineW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW K32GetModuleFileNameExW GetEnvironmentVariableW GetTempPathW WaitForSingleObject CreateFileW GetFileAttributesW GetModuleHandleA OpenProcess Sleep GetLastError CloseHandle GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter SetDllDirectoryW LoadLibraryExW GetExitCodeProcess GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapSize RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc MultiByteToWideChar HeapFree VirtualProtect CompareStringW LCMapStringW GetFileType GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

Name

.text

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21.8MB

Virtual Size

21.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

x147710284c3c42ac682ade3c8028df78279ed7cac3aa7d27542aa5cfffcd2cef.exe

shell32

kernel32

generic