208a347ec45ceb9f4c9ddda0672b2f05638b903a22ff059f4433bdd038a3ef37[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
208a347ec45ceb9f4c9ddda0672b2f05638b903a22ff059f4433bdd038a3ef37.exe
Size 445KB
Sample260708-mcfajafs8j
SHA256 208a347ec45ceb9f4c9ddda0672b2f05638b903a22ff059f4433bdd038a3ef37
MD5 d678578893bf583fa6325e3acd041c37
SHA1 d0b7e8e520cf311ac131d29361e20265f12b8d50
SHA512 83cb1e4130cdea2c0f29b0dba25216de2dbe2098f32da7cc15433e99cea0f76d606465d928fac845ce855fe64309bb8fa7925ebc5f8592c95a02e3df9e3bb3f2
SSDEEP 6144:bC1ta3Bjfh9OOWK76toU+5fTrd5cyveAwci4tpvo4Ay:bC1A5fh9OOJ76toU+5fTe4phA
TLSH
T185A47D6AFA6801D4E12BD039E53B8205D7B77C69039087CB2AA472667F37ED45E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
208a347ec45ceb9f4c9ddda0672b2f05638b903a22ff059f4433bdd038a3ef37.exe

File Explorer

208a347ec45ceb9f4c9ddda0672b2f05638b903a22ff059f4433bdd038a3ef37.exe

.exe 445KB

208a347ec45ceb9f4c9ddda0672b2f05638b903a22ff059f4433bdd038a3ef37.exe

IMPHASH 4339589298932b317550f36d40ab55c1
SHA256 208a347ec45ceb9f4c9ddda0672b2f05638b903a22ff059f4433bdd038a3ef37
MD5 d678578893bf583fa6325e3acd041c37
SHA1 d0b7e8e520cf311ac131d29361e20265f12b8d50
SHA512 83cb1e4130cdea2c0f29b0dba25216de2dbe2098f32da7cc15433e99cea0f76d606465d928fac845ce855fe64309bb8fa7925ebc5f8592c95a02e3df9e3bb3f2
SSDEEP 6144:bC1ta3Bjfh9OOWK76toU+5fTrd5cyveAwci4tpvo4Ay:bC1A5fh9OOJ76toU+5fTe4phA
TLSH
T185A47D6AFA6801D4E12BD039E53B8205D7B77C69039087CB2AA472667F37ED45E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

152868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcessId WideCharToMultiByte VirtualQuery CreateEventW SetEvent ResetEvent GetSystemTimeAsFileTime lstrcmpiW LoadLibraryExW WriteConsoleW CreateFileW FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW CloseHandle VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx WriteFile GetStdHandle GetCommandLineA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW GlobalFlags MultiByteToWideChar GetFileAttributesW FindClose GetModuleFileNameW TerminateProcess GetCurrentProcess FindNextFileW GetCommandLineW GetSystemInfo SetLastError FreeLibrary GetProcAddress LoadLibraryW GetTickCount ExitProcess FindResourceW LoadResource LockResource FreeResource InitializeCriticalSection SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetModuleHandleW IsDebuggerPresent GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree

user32

GetClassInfoExW CharNextW PostQuitMessage DestroyAcceleratorTable BeginPaint RegisterClassExW SetWindowLongPtrW GetWindowTextW EndPaint DeleteMenu GetNextDlgTabItem IsIconic UnregisterClassW MessageBoxW DestroyWindow IsWindow DefWindowProcW DispatchMessageW TranslateMessage GetMessageW PeekMessageW GetWindowLongW SetWindowTextW GetDlgItem GetClassNameW IntersectRect IsRectEmpty WinHelpW SetMenu GetSysColor IsChild GetDlgCtrlID IsDialogMessageW DrawIcon RedrawWindow FillRect SetWindowRgn GetFocus CallWindowProcW GetSystemMenu GetLastActivePopup GetWindowTextLengthW SetRect IsZoomed GetTopWindow ClientToScreen DestroyIcon ScreenToClient DestroyMenu TranslateAcceleratorW InvalidateRect SendMessageW SetWindowPos SetWindowLongW GetKeyState SetCursor GetWindow ShowWindow EnableWindow AdjustWindowRectEx ReleaseDC GetClientRect GetSystemMetrics GetDC GetWindowRect LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW GetActiveWindow LoadStringW GetWindowThreadProcessId IsWindowVisible MonitorFromWindow SetActiveWindow GetMonitorInfoW IsWindowEnabled EnumWindows SetFocus EnumDisplaySettingsW UpdateWindow PostMessageW CreateWindowExW GetWindowLongPtrW

gdi32

CreateEllipticRgn CreateSolidBrush CreateRoundRectRgn GetClipBox CreateFontIndirectW SelectObject CreateDIBSection SetDIBColorTable CreateCompatibleDC GdiAlphaBlend DeleteObject SetStretchBltMode GetObjectW DeleteDC GetDeviceCaps GetStockObject StretchBlt

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegCloseKey

shell32

DragFinish DragQueryFileW Shell_NotifyIconW

ole32

CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

oleaut32

VarUI4FromStr

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControlsEx

ws2_32

WSACleanup

gdiplus

GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdipGetImagePixelFormat GdipGetImageHeight GdipBitmapLockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipSetCompositingMode GdipGetImageWidth GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipGetImagePaletteSize GdiplusStartup GdiplusShutdown GdipFree

Name

.text

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

208a347ec45ceb9f4c9ddda0672b2f05638b903a22ff059f4433bdd038a3ef37.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

gdiplus

generic