hdyfk7a0klsx135kgfxw2764[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
hdyfk7a0klsx135kgfxw2764.exe
Size 2.2MB
Sample260630-ej4mpsd19v
SHA256 12b7b9a5f6dd875791a892bafb8f932f1ae74290d630327b1d2253de452be9f9
MD5 4d2424b7884d8819bd2bb182e2ca8b7c
SHA1 bf75a35ffd3afca784f023371af62437be6fa88c
SHA512 bd02cdcd557dd97a2ec669754a84e4cf617768241800d64bc045b45ba5526a22f6bfe61b86d1a6f6048c12dbcba93bbbf960030c45515278409a7ec0af94c12c
SSDEEP 49152:eJfmkG7EvjRbVJsSPNplvNW4xAsbrQHefkDDY8rscYo:IFvJsSFE0rQHefkDDY8rs
TLSH
T1CFB5AF0BA6E900E8D3BEC178C52A9543E771B42993A4C7EF27E455950F232DA1FF6B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hdyfk7a0klsx135kgfxw2764.exe

File Explorer

hdyfk7a0klsx135kgfxw2764.exe

.exe 2.2MB

hdyfk7a0klsx135kgfxw2764.exe

IMPHASH 2e7944e7fba3931972b713436792aa56
SHA256 12b7b9a5f6dd875791a892bafb8f932f1ae74290d630327b1d2253de452be9f9
MD5 4d2424b7884d8819bd2bb182e2ca8b7c
SHA1 bf75a35ffd3afca784f023371af62437be6fa88c
SHA512 bd02cdcd557dd97a2ec669754a84e4cf617768241800d64bc045b45ba5526a22f6bfe61b86d1a6f6048c12dbcba93bbbf960030c45515278409a7ec0af94c12c
SSDEEP 49152:eJfmkG7EvjRbVJsSPNplvNW4xAsbrQHefkDDY8rscYo:IFvJsSFE0rQHefkDDY8rs
TLSH
T1CFB5AF0BA6E900E8D3BEC178C52A9543E771B42993A4C7EF27E455950F232DA1FF6B01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

889980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetThreadPriority DeleteFileA CreateSemaphoreExW GetCurrentThread Sleep FreeLibrary ExitProcess GetProcAddress FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW RtlUnwind PeekNamedPipe GetEnvironmentVariableA SleepEx GetSystemDirectoryW MoveFileExW lstrcmpW AreFileApisANSI GetFullPathNameW GetFileInformationByHandle FindFirstFileW GetCurrentDirectoryW IsDebuggerPresent DebugBreak WideCharToMultiByte GetModuleHandleW GetProcessHeap CloseHandle LoadLibraryA GetLastError OpenProcess GetModuleHandleA WaitForSingleObject FindClose FindNextFileA GetUserDefaultLocaleName TerminateProcess GetCurrentProcessId CreateMutexExW HeapAlloc LoadLibraryW OpenSemaphoreW WaitForSingleObjectEx OutputDebugStringW FormatMessageW MultiByteToWideChar ReleaseMutex GetCurrentThreadId GetModuleFileNameW GetModuleHandleExW ReleaseSemaphore SetLastError CopyFileW HeapFree GetCurrentProcess FindFirstFileA WaitForMultipleObjects FormatMessageA RtlPcToFileHeader RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive IsProcessorFeaturePresent LocalFree GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW SwitchToThread GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetSystemTimeAsFileTime GetFileInformationByHandleEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead SetEvent CreateThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW VerSetConditionMask VerifyVersionInfoW DuplicateHandle InterlockedPushEntrySList UnmapViewOfFile GetSystemInfo GetFileSizeEx WriteFile SetEndOfFile CreateMutexA CreateFileA CreateFileMappingA RemoveDirectoryA CreateDirectoryA CreateSemaphoreA GetTickCount MapViewOfFileEx GetProcessTimes Process32First GetProcessId CreateToolhelp32Snapshot Process32Next GetExitCodeProcess CreateFileW ReadFile RtlUnwindEx InitializeCriticalSectionAndSpinCount ExitThread GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileAttributesExW GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateDirectoryW GetTimeZoneInformation FlushFileBuffers ReadConsoleW HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle DeleteFileW HeapSize WriteConsoleW GetModuleFileNameA

user32

DestroyWindow GetAncestor ReleaseCapture UpdateWindow SetWindowLongPtrA DefWindowProcW LoadImageA GetMessageW RegisterClassExA PostMessageW SetWindowPos SetProcessDpiAwarenessContext LoadCursorA CreateWindowExA GetParent PostQuitMessage GetClientRect SendMessageA TranslateMessage SetFocus DefWindowProcA AdjustWindowRect MoveWindow GetWindowLongA CallWindowProcA SetWindowLongA DispatchMessageW IsWindow ShowWindow GetWindowPlacement RegisterClassExW GetWindowLongPtrW SetWindowTextW GetSystemMetrics CreateWindowExW PostMessageA SetWindowLongPtrW LoadIconA

advapi32

CryptEncrypt SetSecurityDescriptorDacl RegGetValueA RegCreateKeyExA RegQueryValueExA RegSetValueExA RegOpenKeyExA RegCloseKey RegOpenKeyExW RegQueryValueExW InitializeSecurityDescriptor CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey

shell32

SHGetFolderPathW ShellExecuteExA

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CoTaskMemAlloc

shlwapi

PathCombineW PathFindFileNameW

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

crypt32

CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CryptStringToBinaryA CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine

bcrypt

BCryptGenRandom

ws2_32

recv setsockopt socket WSAIoctl __WSAFDIsSet select htonl getsockname getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname getpeername getsockopt htons connect bind accept WSACleanup WSAStartup inet_ntop WSASetLastError ntohs inet_pton send closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent listen WSACloseEvent WSAGetLastError