_0772222da6439008a68e4b78a383d8f2d36196a9f3b7fa53827829d011748f61[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
_0772222da6439008a68e4b78a383d8f2d36196a9f3b7fa53827829d011748f61.exe
Size 6.2MB
Sample260629-e1tttses5p
SHA256 0772222da6439008a68e4b78a383d8f2d36196a9f3b7fa53827829d011748f61
MD5 3e10ed795cd53130b94c1b40e9353003
SHA1 105882ea5c74b45ed2ceec9d23eda328167f4038
SHA512 703af61c1a918cc79785279bfd2340141f3630eebb497bbbe3826f1ead2a91793c998710f54508e71999a5c26ff74c91e275b434abb2ccf31e520fd3a626a189
SSDEEP 98304:sUvL6+huAt1wTFHNxZemyphjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInEf:sY11kdemyujpu6a67buEjcmUInErzvF
TLSH
T1F166F103E1E78EF4D12BE67D46629373AD2470885E33B11C29A5F36A5FE0938A15DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_0772222da6439008a68e4b78a383d8f2d36196a9f3b7fa53827829d011748f61.exe

File Explorer

_0772222da6439008a68e4b78a383d8f2d36196a9f3b7fa53827829d011748f61.exe

.exe 6.2MB

_0772222da6439008a68e4b78a383d8f2d36196a9f3b7fa53827829d011748f61.exe

IMPHASH ffb5c52510590f5ee669e71a9d4cdf52
SHA256 0772222da6439008a68e4b78a383d8f2d36196a9f3b7fa53827829d011748f61
MD5 3e10ed795cd53130b94c1b40e9353003
SHA1 105882ea5c74b45ed2ceec9d23eda328167f4038
SHA512 703af61c1a918cc79785279bfd2340141f3630eebb497bbbe3826f1ead2a91793c998710f54508e71999a5c26ff74c91e275b434abb2ccf31e520fd3a626a189
SSDEEP 98304:sUvL6+huAt1wTFHNxZemyphjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInEf:sY11kdemyujpu6a67buEjcmUInErzvF
TLSH
T1F166F103E1E78EF4D12BE67D46629373AD2470885E33B11C29A5F36A5FE0938A15DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CreateDirectoryA CreateEventA CreateFileA CreateFileMappingW CreateFileW CreateProcessA CreateSemaphoreA DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection FindClose FindFirstFileA FindNextFileA FindResourceW FlushViewOfFile FormatMessageA GetCPInfo GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileInformationByHandle GetFileSize GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTickCount64 InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MoveFileExA MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEvent SetFileAttributesA SetFilePointer SetLastError SetPriorityClass SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp _setmode _strdup _stricmp _strtoi64 _strtoui64 _time64 _unlock _vscprintf _vsnprintf _wfopen _write abort atexit calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset putc putwc realloc setlocale setvbuf strchr strcmp strcoll strcpy_s strerror strftime strlen strncmp strstr strtoul strxfrm tolower towupper ungetwc towlower ungetc vfprintf vswprintf_s wcscoll wcscpy_s wcsftime wcslen wcstombs wcsxfrm

ntdll

NtClose NtCreateSection NtMapViewOfSection NtOpenFile NtSetInformationFile NtWriteFile RtlInitUnicodeString

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

CommandLineToArgvW ShellExecuteExA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

Name

.itext

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xdata

Size

198KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

_0772222da6439008a68e4b78a383d8f2d36196a9f3b7fa53827829d011748f61.exe

advapi32

kernel32

msvcrt

ntdll

ole32

oleaut32

shell32

winhttp

generic