testtttttttttttttttttttttttttttttttttt[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
testtttttttttttttttttttttttttttttttttt.exe
Size 2.1MB
Sample260708-ql2fxag16n
SHA256 24b1899187018a27b260fdd3051a218b130eb29a4b1db2cfc22fad92331dff52
MD5 1b965e9eb385783d56368bb137e1fb9a
SHA1 ba4d218adf52320eec2aefa8c1286b4ba9dbcff1
SHA512 f86007bba3d37701c9131199563ad1bc44724fd86b1f16f05036bebd50df6445749d13a7b02a065846ba1835479ee2d1424e8a80d9c8747f7fe87231c591da29
SSDEEP 24576:+tnUrMjtW0QymAP+SjdPc+TmLHf9Fs7UiGSyudGmWVIH06iy9FMEV:+tUrM/QyRP/TmDA7UiGSTuIU6isLV
TLSH
T1E3A57D03E6A580EDC1AEC178C7579B33FA33B88D053076AB67D45B212E26F506B1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
testtttttttttttttttttttttttttttttttttt.exe

File Explorer

testtttttttttttttttttttttttttttttttttt.exe

.exe 2.1MB

testtttttttttttttttttttttttttttttttttt.exe

IMPHASH 0b3e2425a0b6ec6e0a71120b3db6481d
SHA256 24b1899187018a27b260fdd3051a218b130eb29a4b1db2cfc22fad92331dff52
MD5 1b965e9eb385783d56368bb137e1fb9a
SHA1 ba4d218adf52320eec2aefa8c1286b4ba9dbcff1
SHA512 f86007bba3d37701c9131199563ad1bc44724fd86b1f16f05036bebd50df6445749d13a7b02a065846ba1835479ee2d1424e8a80d9c8747f7fe87231c591da29
SSDEEP 24576:+tnUrMjtW0QymAP+SjdPc+TmLHf9Fs7UiGSyudGmWVIH06iy9FMEV:+tUrM/QyRP/TmDA7UiGSTuIU6isLV
TLSH
T1E3A57D03E6A580EDC1AEC178C7579B33FA33B88D053076AB67D45B212E26F506B1DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameW SystemFunction036

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertOpenStore CertVerifyTimeValidity

kernel32

CancelIo CloseHandle CreateEventW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileW DuplicateHandle FindClose FindFirstFileExW FindNextFileW FreeLibrary GetComputerNameExW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetSystemDirectoryW GetSystemTimePreciseAsFileTime GetTempPathW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete LoadLibraryA MapViewOfFile PostQueuedCompletionStatus ReadFile ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WriteFileEx AddVectoredExceptionHandler CompareStringOrdinal CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetStdHandle InitializeCriticalSection LeaveCriticalSection Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter VirtualProtect VirtualQuery WriteConsoleW __C_specific_handler

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSARecv WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv select send setsockopt

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

604KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

testtttttttttttttttttttttttttttttttttt.exe

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

bcryptprimitives

crypt32

kernel32

ntdll

ws2_32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

generic