YjZVSABsMraQrxuw[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
YjZVSABsMraQrxuw.exe
Size 49.2MB
Sample260708-je6cyscx2x
SHA256 67237356385f0b4392f41998efd1e38687a5d8af0d98fe14b4d0c1c3c7f63c19
MD5 c316e41288e6a3b77d98dbccd76a9b5a
SHA1 d1e1d161abc3464bf76e297ff1d9fffc2ece425a
SHA512 7767d402e5ba1f330763d212422bd23e7cd7af0b845847972c480ba9fc4aa2d967c6640b569d87ffc2ae5bf05de728b3bf4993b710c86188da5bf497c96504ae
SSDEEP 786432:ytmZVWeyVUhjb6j6BpgO7svc3+Gwm70MLWo+lQMC8gM8+IfWxUNT:IEW1ahb6egOGcul6nheQvVf8U
TLSH
T18AB7338A36E9A7E4D092C9115ECB5297C1C4F2A7F6DA8D1E3CC198053360C479F87E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
YjZVSABsMraQrxuw.exe

File Explorer

YjZVSABsMraQrxuw.exe

.exe 49.2MB

YjZVSABsMraQrxuw.exe

IMPHASH 60b3fec68cc0cdca79c3a862b87e6bee
SHA256 67237356385f0b4392f41998efd1e38687a5d8af0d98fe14b4d0c1c3c7f63c19
MD5 c316e41288e6a3b77d98dbccd76a9b5a
SHA1 d1e1d161abc3464bf76e297ff1d9fffc2ece425a
SHA512 7767d402e5ba1f330763d212422bd23e7cd7af0b845847972c480ba9fc4aa2d967c6640b569d87ffc2ae5bf05de728b3bf4993b710c86188da5bf497c96504ae
SSDEEP 786432:ytmZVWeyVUhjb6j6BpgO7svc3+Gwm70MLWo+lQMC8gM8+IfWxUNT:IEW1ahb6egOGcul6nheQvVf8U
TLSH
T18AB7338A36E9A7E4D092C9115ECB5297C1C4F2A7F6DA8D1E3CC198053360C479F87E7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93720077

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenRandom

crypt32

CertOpenStore

ws2_32

select

kernel32

FreeLibrary GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

UpdateWindow

advapi32

CheckTokenMembership

shell32

SHGetFolderPathW

ole32

CoSetProxyBlanket

oleaut32

VariantClear

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

ntdll

RtlFreeUnicodeString

wintrust

WinVerifyTrust

winhttp

WinHttpReceiveResponse

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-math-l1-1-0

fmodf

api-ms-win-crt-runtime-l1-1-0

_invoke_watson

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-string-l1-1-0

strcat_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-time-l1-1-0

_gmtime64_s

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1011KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.[Nw

Size

Virtual Size

41.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.x/X

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.*]e

Size

49.2MB

Virtual Size

49.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

YjZVSABsMraQrxuw.exe

bcrypt

crypt32

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

d3d11

imm32

d3dcompiler_47

ntdll

wintrust

winhttp

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic