d2c5366b14d49eb262250ae1e7656d121b42ff1b32bc59d2bb82ffc0698095ce[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
d2c5366b14d49eb262250ae1e7656d121b42ff1b32bc59d2bb82ffc0698095ce.exe
Size 16.7MB
Sample260702-c6lpasbs9x
SHA256 d2c5366b14d49eb262250ae1e7656d121b42ff1b32bc59d2bb82ffc0698095ce
MD5 964794ea13c9aadad99cd7a99b578198
SHA1 39b6e2cc9371edc6f9e725209603e1bb6c2353cb
SHA512 8582a7cb748c791d71bc025776457273e556b95ed30e70207a889d669d75e26c16c27789d45cc84d9beda66c970e1684fa5f72dc7d8b22196ea4c6cffd1383f2
SSDEEP 98304:welCES9lyQXMeyYpedek7djQpDpzuM+QjtUso+LI:5sEwyKByZXspDFx+sxI
TLSH
T1E0077DBCB633D2D2DE4A032AA600BBC50B771A7B154765B8E33D669066C0D2F673C5E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2c5366b14d49eb262250ae1e7656d121b42ff1b32bc59d2bb82ffc0698095ce.exe

File Explorer

d2c5366b14d49eb262250ae1e7656d121b42ff1b32bc59d2bb82ffc0698095ce.exe

.exe 16.7MB

d2c5366b14d49eb262250ae1e7656d121b42ff1b32bc59d2bb82ffc0698095ce.exe

IMPHASH 1159171368f58047064f13974f1ffefc
SHA256 d2c5366b14d49eb262250ae1e7656d121b42ff1b32bc59d2bb82ffc0698095ce
MD5 964794ea13c9aadad99cd7a99b578198
SHA1 39b6e2cc9371edc6f9e725209603e1bb6c2353cb
SHA512 8582a7cb748c791d71bc025776457273e556b95ed30e70207a889d669d75e26c16c27789d45cc84d9beda66c970e1684fa5f72dc7d8b22196ea4c6cffd1383f2
SSDEEP 98304:welCES9lyQXMeyYpedek7djQpDpzuM+QjtUso+LI:5sEwyKByZXspDFx+sxI
TLSH
T1E0077DBCB633D2D2DE4A032AA600BBC50B771A7B154765B8E33D669066C0D2F673C5E1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

357628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wrapper.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

GetProcessHeap HeapFree HeapReAlloc GetCurrentProcess LoadLibraryA GetProcAddress CloseHandle GetLastError GetCurrentThreadId GetCurrentThread RtlCaptureContext ReleaseMutex SetLastError GetCurrentDirectoryW WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers WaitForSingleObject HeapSize MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW CreateDirectoryW GetFullPathNameW FindFirstFileExW FindClose GetFileInformationByHandle SetFilePointerEx CreateFileW SetFileInformationByHandle GetModuleHandleW FormatMessageW GetModuleHandleA GetModuleFileNameW SetThreadStackGuarantee SleepEx ReadFileEx WriteFileEx GetSystemTimePreciseAsFileTime CreateWaitableTimerExW SetWaitableTimer Sleep ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateThread LCMapStringW WaitForMultipleObjects GetExitCodeProcess CompareStringW LoadLibraryExA CopyFileExW GetCommandLineW AllocConsole GetTickCount64 SwitchToThread CreateMutexW AddVectoredExceptionHandler LoadLibraryExW VirtualProtect GetFileInformationByHandleEx QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwind FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RaiseException WriteFile TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA IsDebuggerPresent UnhandledExceptionFilter FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW DecodePointer

advapi32

RegCloseKey RegOpenKeyExW SystemFunction036 RegQueryValueExW

ole32

CoUninitialize CoCreateInstance CoInitializeEx

bcrypt

BCryptGenRandom

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile NtCreateNamedPipeFile

oleaut32

SysStringLen SysFreeString GetErrorInfo

Name

.text

Size

412KB

Virtual Size

411KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16.1MB

Virtual Size

16.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d2c5366b14d49eb262250ae1e7656d121b42ff1b32bc59d2bb82ffc0698095ce.exe

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ole32

bcrypt

ntdll

oleaut32

generic