d7f5b6866690b8747c59fbf14c71266472fd5d581107f89a02a85acf45938c65[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
d7f5b6866690b8747c59fbf14c71266472fd5d581107f89a02a85acf45938c65.exe
Size 352KB
Sample260708-j2fqtacz3t
SHA256 d7f5b6866690b8747c59fbf14c71266472fd5d581107f89a02a85acf45938c65
MD5 391e52df75353e95344c6d53afffc195
SHA1 b1d4ded92319187d48ca7fcd1ad39b22e76d440b
SHA512 b8bd6df28710023244346783d3dd3fdf8daef4fbd5c4458b54b9d95a497533f73cec09c2be7236a6785870284633b073f4dbeaac0b3181dbcd82fc571c3f1c2f
SSDEEP 384:IKImV5sj360X2lA7dp36l4shw0BXr5idxGY:I7PXmlAP3yFtBF
TLSH
T107749603FBA84A69E0AA07B049374A9757BAFB5556F3C31F054083890DF4AB0DC6E793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d7f5b6866690b8747c59fbf14c71266472fd5d581107f89a02a85acf45938c65.exe

File Explorer

d7f5b6866690b8747c59fbf14c71266472fd5d581107f89a02a85acf45938c65.exe

.exe 352KB

d7f5b6866690b8747c59fbf14c71266472fd5d581107f89a02a85acf45938c65.exe

IMPHASH 71a37a69b2ed22ed534999f1d8722060
SHA256 d7f5b6866690b8747c59fbf14c71266472fd5d581107f89a02a85acf45938c65
MD5 391e52df75353e95344c6d53afffc195
SHA1 b1d4ded92319187d48ca7fcd1ad39b22e76d440b
SHA512 b8bd6df28710023244346783d3dd3fdf8daef4fbd5c4458b54b9d95a497533f73cec09c2be7236a6785870284633b073f4dbeaac0b3181dbcd82fc571c3f1c2f
SSDEEP 384:IKImV5sj360X2lA7dp36l4shw0BXr5idxGY:I7PXmlAP3yFtBF
TLSH
T107749603FBA84A69E0AA07B049374A9757BAFB5556F3C31F054083890DF4AB0DC6E793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CreateEventW CreateProcessW CreateToolhelp32Snapshot DelayLoadFailureHook DeleteFileW ExitProcess FindClose FindFirstFileW FindNextFileW GetCommandLineW GetComputerNameW GetExitCodeProcess GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileSectionW GetProcAddress GetSystemDirectoryW GetSystemFirmwareTable GetSystemWow64DirectoryW GetTickCount GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsWow64Process LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW RemoveDirectoryW ResetEvent ResolveDelayLoadedAPI SetComputerNameExA SetCurrentDirectoryW SetEvent TerminateProcess UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection lstrcmpiW

ntdll

NtCreateEvent NtOpenSection NtPowerInformation NtQuerySystemInformation RtlGetVersion RtlInitUnicodeString _vsnprintf

advapi32

ConvertSidToStringSidW GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf __stdio_common_vswprintf _chsize _close _configure_narrow_argv _errno _fstat32 _get_initial_narrow_environment _initialize_narrow_environment _lseek _read _set_app_type _strdup _wgetenv _wopen _write exit free fwrite getenv memcmp memmove memset qsort strchr strcmp strcpy strcspn strerror strlen strncmp strtoul wcschr wcscmp wcscpy wcsncmp

ws2_32

freeaddrinfo getaddrinfo gethostname

Name

.text

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

32KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

176KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

28KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d7f5b6866690b8747c59fbf14c71266472fd5d581107f89a02a85acf45938c65.exe

kernel32

ntdll

advapi32

ucrtbase

ws2_32

generic