21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe
Size 1.9MB
Sample260706-e2wptadv5n
SHA256 21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863
MD5 702f732f25e128d0419c40d95cfd9e79
SHA1 5dfaa76ef4b04a72af1dbcf2f39703059c53b0d1
SHA512 b92a50d2bbc6adebefcecb29059e8186d81695ac68127ab479bc96c70f3dc590b7d5845cdf8fa83e998aae52623531cc8374d8ee23ef6e090c235632fb74653e
SSDEEP 12288:7L6zPpxl0pNjMjMwBU3Vo29ANzUzv3IgNaSWYdU4881GNT0Qkb3NnX+SWm8dNgt8:7L0pxeLjb8GVnOTJ0SU1MzykDEXm9
TLSH
T1FD959324B9BA812DD037FFB83EDDF49EEDEB2A151544646B0142034B8A26AD0CF5B53D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe

File Explorer

21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe

.exe 1.9MB

21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe

IMPHASH 98509f427951e79372ff4d41a60cebc0
SHA256 21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863
MD5 702f732f25e128d0419c40d95cfd9e79
SHA1 5dfaa76ef4b04a72af1dbcf2f39703059c53b0d1
SHA512 b92a50d2bbc6adebefcecb29059e8186d81695ac68127ab479bc96c70f3dc590b7d5845cdf8fa83e998aae52623531cc8374d8ee23ef6e090c235632fb74653e
SSDEEP 12288:7L6zPpxl0pNjMjMwBU3Vo29ANzUzv3IgNaSWYdU4881GNT0Qkb3NnX+SWm8dNgt8:7L0pxeLjb8GVnOTJ0SU1MzykDEXm9
TLSH
T1FD959324B9BA812DD037FFB83EDDF49EEDEB2A151544646B0142034B8A26AD0CF5B53D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

142400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadProcessMemory GetCurrentProcessId CreateProcessW GetModuleHandleW FreeLibrary WideCharToMultiByte lstrcmpW CreateDirectoryW SizeofResource VirtualProtect WriteFile GetTempPathW GetFileAttributesW GetSystemDirectoryW MultiByteToWideChar LockResource LoadResource FindResourceW CopyFileW GetSystemTimeAsFileTime SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW ExitProcess GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP LocalFree GetWindowsDirectoryW LoadLibraryW Process32FirstW DeleteFileW Process32NextW CreateToolhelp32Snapshot OpenProcess CreateFileW LocalAlloc WaitForSingleObject GetModuleFileNameW DeviceIoControl FindNextFileW GetFullPathNameW GetCommandLineW FindFirstFileW GetStartupInfoW CheckRemoteDebuggerPresent GetComputerNameA IsDebuggerPresent QueryPerformanceCounter GetProcessHeap DeleteCriticalSection GetProcAddress GetThreadContext DecodePointer HeapAlloc CloseHandle HeapReAlloc QueryPerformanceFrequency GetCurrentThread GetLastError GetTickCount64 Sleep HeapSize GetModuleHandleA FindClose InitializeCriticalSectionEx FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle RtlUnwind GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue OutputDebugStringA GetCurrentProcess SetLastError HeapFree GetCommandLineA TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException OutputDebugStringW GetCPInfo SleepConditionVariableSRW GetStringTypeW FindFirstFileExW GetCurrentThreadId EncodePointer EnterCriticalSection LeaveCriticalSection LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable

user32

GetWindowThreadProcessId SendMessageW GetTopWindow GetWindowRect MessageBoxW GetWindow FindWindowW GetCursorPos GetWindowTextW GetSystemMetrics FindWindowA IsWindowVisible

advapi32

CloseServiceHandle RegQueryInfoKeyA GetUserNameA RegCloseKey GetTokenInformation RegQueryValueExW CreateServiceW QueryServiceStatus DeleteService ControlService StartServiceW LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf RegDeleteKeyA RegOpenKeyExA OpenSCManagerW SetTokenInformation AllocateAndInitializeSid LookupPrivilegeNameW RegCreateKeyExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA OpenProcessToken FreeSid SetThreadToken CheckTokenMembership RegOpenKeyExW CreateProcessAsUserW OpenServiceW DuplicateTokenEx QueryServiceStatusEx

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoTaskMemFree CoCreateGuid CoInitializeEx CoGetObject CoInitialize IIDFromString CoUninitialize StringFromCLSID CoCreateInstance

oleaut32

VariantClear

shlwapi

PathStripToRootW PathRemoveFileSpecW

iphlpapi

CreateIpForwardEntry GetAdaptersInfo DeleteIpForwardEntry FlushIpNetTable GetIpForwardTable

ws2_32

connect setsockopt sendto htons recvfrom inet_ntoa socket WSAStartup inet_pton closesocket WSACleanup

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

userenv

RefreshPolicyEx

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

psapi

GetModuleFileNameExW

Name

.text

Size

287KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

610KB

Virtual Size

610KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

ws2_32

setupapi

userenv

rpcrt4

psapi

generic