e6e448215af5a4f173a89a0c9f829d6abf3fce275af2317310c3bb448a0c35ad[.]exe

General

Target
e6e448215af5a4f173a89a0c9f829d6abf3fce275af2317310c3bb448a0c35ad.exe
Size 115KB
Sample260708-ter6fab18p
SHA256 e6e448215af5a4f173a89a0c9f829d6abf3fce275af2317310c3bb448a0c35ad
MD5 b944a42b972dd31fc05e28bb9d03a28a
SHA1 1ec3ea8cff33b1158978b0ef15948f13effa3b25
SHA512 9be6cb279ae2c7935d60627f9323d1f720b1067369ccb8e28452c328e32a2fe07cab68b9dc2d01d37afc49a60c37699b5d543217aec15c004c818d47c826cad4
SSDEEP 3072:ldstQgsy3iOjfoF5P5GO4AmAI5Oqo67MWl77m:tgsyJ8P5GO1M5GQHm
TLSH
T17BC3499777E530F8E1738279C8624605EBB6B83117609FEF0364465A1F236D19D3AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e6e448215af5a4f173a89a0c9f829d6abf3fce275af2317310c3bb448a0c35ad.exe

File Explorer

e6e448215af5a4f173a89a0c9f829d6abf3fce275af2317310c3bb448a0c35ad.exe

.exe 115KB

e6e448215af5a4f173a89a0c9f829d6abf3fce275af2317310c3bb448a0c35ad.exe

IMPHASH 42338b8937c8d3534e2baffc107e713b
SHA256 e6e448215af5a4f173a89a0c9f829d6abf3fce275af2317310c3bb448a0c35ad
MD5 b944a42b972dd31fc05e28bb9d03a28a
SHA1 1ec3ea8cff33b1158978b0ef15948f13effa3b25
SHA512 9be6cb279ae2c7935d60627f9323d1f720b1067369ccb8e28452c328e32a2fe07cab68b9dc2d01d37afc49a60c37699b5d543217aec15c004c818d47c826cad4
SSDEEP 3072:ldstQgsy3iOjfoF5P5GO4AmAI5Oqo67MWl77m:tgsyJ8P5GO1M5GQHm
TLSH
T17BC3499777E530F8E1738279C8624605EBB6B83117609FEF0364465A1F236D19D3AF22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Final PLAN 100% Finalized\Protoolskit\UpdateDownloader Version 2 (Original) Updated by Anees\x64\Release\UpdateDownloader.pdb

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpConnect

kernel32

ExitProcess WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc CreateDirectoryW ReadFile WriteFile GetModuleFileNameW SetFilePointer CreateFileW Sleep GetLastError DeleteFileW CloseHandle CreateThread GetFileSize CreateProcessW CopyFileW HeapSize GetProcessHeap LCMapStringW CompareStringW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetCurrentProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW

user32

wsprintfW

shlwapi

PathFileExistsW

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e6e448215af5a4f173a89a0c9f829d6abf3fce275af2317310c3bb448a0c35ad.exe

winhttp

kernel32

user32

shlwapi

generic