a650dcca0a2b82d36b0e6057c64d70a4a7d1ddc0986941666a87dae2205b9a3d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a650dcca0a2b82d36b0e6057c64d70a4a7d1ddc0986941666a87dae2205b9a3d.exe
Size 419KB
Sample260709-jfvb3sez4v
SHA256 a650dcca0a2b82d36b0e6057c64d70a4a7d1ddc0986941666a87dae2205b9a3d
MD5 38e53878cb31b18ae7bc73e464104515
SHA1 320ff787d8695e18774619602b75c89f830f3dda
SHA512 ccf67ab1a3225bd4893c476187183f2af0d50e4daf7cdff1e891bad2c3cdc2bf7dc0fb0f35fa209dcd16cfc97891c1297965d3099de05634fd75bf4c726b6878
SSDEEP 6144:jatygN+TkFSLZ+knaTDH76VFwcEOkCybEaQRXr9HNdvOa:jatG+S9+kaTDHrOkx2LIa
TLSH
T156948C19FAA08076C563857AC4E257A6FBB1B5223B109ACF639007565F237E3BD3530E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a650dcca0a2b82d36b0e6057c64d70a4a7d1ddc0986941666a87dae2205b9a3d.exe

File Explorer

a650dcca0a2b82d36b0e6057c64d70a4a7d1ddc0986941666a87dae2205b9a3d.exe

.exe 419KB

a650dcca0a2b82d36b0e6057c64d70a4a7d1ddc0986941666a87dae2205b9a3d.exe

IMPHASH 5537b1abd6ccf73ee443949c9bcbba64
SHA256 a650dcca0a2b82d36b0e6057c64d70a4a7d1ddc0986941666a87dae2205b9a3d
MD5 38e53878cb31b18ae7bc73e464104515
SHA1 320ff787d8695e18774619602b75c89f830f3dda
SHA512 ccf67ab1a3225bd4893c476187183f2af0d50e4daf7cdff1e891bad2c3cdc2bf7dc0fb0f35fa209dcd16cfc97891c1297965d3099de05634fd75bf4c726b6878
SSDEEP 6144:jatygN+TkFSLZ+knaTDH76VFwcEOkCybEaQRXr9HNdvOa:jatG+S9+kaTDHrOkx2LIa
TLSH
T156948C19FAA08076C563857AC4E257A6FBB1B5223B109ACF639007565F237E3BD3530E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadResource FindResourceW FindResourceExW VirtualQuery LoadLibraryW GetSystemDirectoryW SetCurrentDirectoryW ProcessIdToSessionId Sleep CreateProcessW TerminateProcess LoadLibraryA GetVersionExW CreateFileMappingW MapViewOfFile UnmapViewOfFile QueryPerformanceCounter WinExec GetFileSizeEx ReadFile HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SetHandleCount WriteConsoleW LockResource SizeofResource WideCharToMultiByte CreateThread GetCurrentThread SetThreadPriority SetPriorityClass GetModuleFileNameW ExitProcess SetUnhandledExceptionFilter Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcAddress OpenProcess MultiByteToWideChar GetCurrentProcessId WriteFile GetTickCount GetCurrentThreadId SetFilePointerEx GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle RtlUnwind GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP LCMapStringA IsDebuggerPresent UnhandledExceptionFilter LCMapStringW IsValidCodePage GetOEMCP GetStartupInfoW GetACP GetCPInfo GetSystemTimeAsFileTime HeapCreate InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA CreateFileW GetModuleHandleW GetCurrentProcess OpenMutexW GetLastError CloseHandle CreateMutexW SetFilePointer GetSystemInfo GetModuleHandleA VirtualFree TerminateThread VirtualAlloc VirtualAllocEx WriteProcessMemory CreateRemoteThread GetProcessId SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime GlobalAlloc GlobalFree CreateFileA GetFileType

user32

GetThreadDesktop GetWindowThreadProcessId FindWindowExW FindWindowW wsprintfW OpenDesktopW SetThreadDesktop

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW OpenSCManagerW ControlService StartServiceW CreateServiceW FreeSid CheckTokenMembership AllocateAndInitializeSid CreateProcessAsUserW CloseServiceHandle OpenServiceW

shell32

ShellExecuteExW ShellExecuteW

shlwapi

StrCmpIW PathFileExistsW

wininet

InternetOpenW InternetSetOptionW InternetOpenUrlW HttpSendRequestW InternetQueryOptionW InternetSetOptionA HttpOpenRequestW InternetConnectW InternetCloseHandle InternetReadFile

psapi

GetModuleFileNameExW

ws2_32

WSAStartup socket setsockopt inet_addr sendto recvfrom ntohs closesocket inet_ntoa htonl ntohl htons

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

dnsapi

DnsFree DnsQuery_W

iphlpapi

SendARP GetIpNetTable GetAdaptersInfo