5aaa8e5ae475d0da5d48fdf392eb31096b62589ef79b79d81c189e3f8223bf06[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5aaa8e5ae475d0da5d48fdf392eb31096b62589ef79b79d81c189e3f8223bf06.exe
Size 8.9MB
Sample260707-laa3csby2j
SHA256 5aaa8e5ae475d0da5d48fdf392eb31096b62589ef79b79d81c189e3f8223bf06
MD5 f2bb24f794b819fad5303e7ed2ca5ac6
SHA1 91bdd47ee2abf20c440313e9a13ba32291167d1c
SHA512 5d022a1f08e41759d1e03c46dc219536a74efc8b8c553ab74579f5263f90e15236ca90acb24a7b26df9c7f62403472189f9c4418755221e418dab4c75e04a0f6
SSDEEP 98304:KIZ5GrA16xD06+HE32tuyewBX4u0e4S43TP8M6rcBPdIte+zJoCLyQqTaN1tn+Pc:NOXkuyBkSHa9KoCqMLH
TLSH
T10B962903F66291E8C169C075831AE232FA32BC8947357AEB5BE44F233E55F906B2D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5aaa8e5ae475d0da5d48fdf392eb31096b62589ef79b79d81c189e3f8223bf06.exe

File Explorer

5aaa8e5ae475d0da5d48fdf392eb31096b62589ef79b79d81c189e3f8223bf06.exe

.exe 8.9MB

5aaa8e5ae475d0da5d48fdf392eb31096b62589ef79b79d81c189e3f8223bf06.exe

IMPHASH ce453023aef5c020e65df18a8ba18068
SHA256 5aaa8e5ae475d0da5d48fdf392eb31096b62589ef79b79d81c189e3f8223bf06
MD5 f2bb24f794b819fad5303e7ed2ca5ac6
SHA1 91bdd47ee2abf20c440313e9a13ba32291167d1c
SHA512 5d022a1f08e41759d1e03c46dc219536a74efc8b8c553ab74579f5263f90e15236ca90acb24a7b26df9c7f62403472189f9c4418755221e418dab4c75e04a0f6
SSDEEP 98304:KIZ5GrA16xD06+HE32tuyewBX4u0e4S43TP8M6rcBPdIte+zJoCLyQqTaN1tn+Pc:NOXkuyBkSHa9KoCqMLH
TLSH
T10B962903F66291E8C169C075831AE232FA32BC8947357AEB5BE44F233E55F906B2D754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6387296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

markeron.pdb

bcryptprimitives

ProcessPrng

ntdll

NtDeviceIoControlFile NtOpenFile NtWriteFile NtReadFile RtlGetVersion RtlNtStatusToDosError NtCreateFile NtCreateNamedPipeFile NtCancelIoFileEx

kernel32

SetThreadStackGuarantee GetCurrentThread FreeLibrary HeapReAlloc GetProcessHeap LoadLibraryExW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable GlobalFree SleepConditionVariableSRW GlobalUnlock CreateSemaphoreA SetLastError GetFullPathNameW ReadFile SetConsoleCtrlHandler CreateThread CreateMutexW GlobalAlloc GlobalLock ReleaseMutex SetFileCompletionNotificationModes GetSystemTimeAsFileTime MultiByteToWideChar SetWaitableTimer ReleaseSemaphore FormatMessageW WideCharToMultiByte SwitchToThread GetSystemTimePreciseAsFileTime FindClose GetCurrentProcessId WriteFile lstrlenW RtlPcToFileHeader GetModuleHandleW LCIDToLocaleName WaitForSingleObject GetOverlappedResult CreateIoCompletionPort RaiseException OutputDebugStringW FlsAlloc CancelIoEx LoadLibraryExA GetCurrentThreadId FlsGetValue LoadLibraryA FlsSetValue LoadLibraryW CreateFileW FlsFree RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess HeapAlloc DeviceIoControl SleepEx SetHandleInformation SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW DeleteFileW GetFinalPathNameByHandleW CreateSymbolicLinkW FindNextFileW SetFilePointerEx GetUserDefaultUILanguage CreateProcessW PostQueuedCompletionStatus EncodePointer CreateDirectoryW WriteFileEx ReadFileEx WriteConsoleW GetModuleHandleA GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA CreateWaitableTimerExW GetProcAddress Sleep GetLastError CloseHandle GetQueuedCompletionStatusEx OutputDebugStringA GetSystemInfo HeapFree RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext SetEnvironmentVariableW QueryPerformanceFrequency DeleteCriticalSection InitializeCriticalSectionEx GetEnvironmentVariableW AddVectoredExceptionHandler QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

user32

PeekMessageW GetMonitorInfoW ReleaseCapture FillRect SetWindowPlacement SystemParametersInfoW GetWindowPlacement SetParent SetFocus GetWindow SetTimer KillTimer SetWindowRgn SetCapture TrackMouseEvent GetTouchInputInfo CloseTouchInputHandle TranslateMessage DispatchMessageW PostThreadMessageW GetMessageW GetParent FindWindowExW LoadCursorW SetCursor SetWindowLongPtrW SetPropW ChangeDisplaySettingsExW GetKeyboardState SetWindowTextW DestroyIcon GetWindowTextW GetWindowTextLengthW GetMenu ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout GetKeyState SetWindowLongW GetSystemMenu GetClipCursor AdjustWindowRect GetMessageA ShowCursor ScreenToClient RegisterWindowMessageA GetWindowLongW DispatchMessageA EnumChildWindows SetForegroundWindow RegisterClassW ChangeWindowMessageFilterEx GetMenuItemInfoW SetMenu IsProcessDPIAware UpdateWindow InvalidateRect TrackPopupMenu SetCursorPos GetForegroundWindow InvalidateRgn SetWindowPos GetWindowRect GetClientRect FlashWindowEx EnableMenuItem GetActiveWindow ClientToScreen VkKeyScanW CheckMenuItem DrawTextW SetWindowDisplayAffinity SendInput MapVirtualKeyW GetWindowDC MonitorFromRect OffsetRect MapWindowPoints GetMenuBarInfo RegisterTouchWindow GetSystemMetrics IsWindow CreateWindowExW AdjustWindowRectEx RegisterClassExW ShowWindow IsWindowEnabled EnableWindow MonitorFromPoint GetWindowLongPtrW EnumDisplayMonitors MonitorFromWindow IsIconic IsWindowVisible RegisterRawInputDevices GetCursorPos RedrawWindow SendMessageW PostMessageW DestroyWindow PostQuitMessage SystemParametersInfoA RemoveMenu DrawIconEx AppendMenuW InsertMenuW RegisterHotKey GetAsyncKeyState DefWindowProcW CreateIcon SetMenuItemInfoW CreatePopupMenu CreateMenu CreateAcceleratorTableW RegisterClipboardFormatW DestroyAcceleratorTable DestroyMenu SetClipboardData FindWindowW UnregisterHotKey CloseClipboard EmptyClipboard OpenClipboard ReleaseDC GetDC ClipCursor TranslateAcceleratorW MsgWaitForMultipleObjectsEx GetUpdateRect ValidateRect GetRawInputData DrawMenuBar

gdi32

CombineRgn CreateRectRgn GetDeviceCaps SetBkMode CreateSolidBrush CreateDIBSection DeleteObject DeleteDC GetDIBits BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC SetTextColor

advapi32

RevertToSelf ImpersonateAnonymousToken RegGetValueW RegDeleteValueW RegQueryValueExW RegSetValueExW RegCloseKey RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister SystemFunction036

shell32

Shell_NotifyIconGetRect DragQueryFileW Shell_NotifyIconW DragFinish ShellExecuteW SHGetKnownFolderPath ILFree SHOpenFolderAndSelectItems ILCreateFromPathW ShellExecuteExW SHAppBarMessage SHCreateItemFromParsingName

ole32

CoInitialize CoTaskMemAlloc RegisterDragDrop CoUninitialize CoInitializeEx CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemFree OleInitialize RevokeDragDrop

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

oleaut32

SysFreeString SetErrorInfo GetErrorInfo SysStringLen

comctl32

SetWindowSubclass RemoveWindowSubclass TaskDialogIndirect DefSubclassProc

shlwapi

SHCreateMemStream

ws2_32

WSASend shutdown send recv freeaddrinfo getaddrinfo WSACleanup WSAStartup getsockopt WSAGetLastError bind WSAIoctl ioctlsocket WSASocketW setsockopt closesocket connect getpeername getsockname

crypt32

CertSetCertificateContextProperty CertFreeCertificateChain CertVerifyCertificateChainPolicy CertOpenStore CertGetCertificateChain CertCreateCertificateChainEngine CertFreeCertificateContext CertFreeCertificateChainEngine CertCloseStore CertAddEncodedCertificateToStore

bcrypt

BCryptGenRandom

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _initterm _initterm_e exit strerror _exit _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _register_thread_local_exe_atexit_callback __p___argc __p___argv abort _cexit _c_exit

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s wcslen _wcsicmp strlen

api-ms-win-crt-math-l1-1-0

round roundf pow __setusermatherr trunc floor

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh calloc