ec9416ccf51a95a73d9cbd6a54394212[.]docx[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ec9416ccf51a95a73d9cbd6a54394212.docx.exe
Size 1.5MB
Sample260713-kcwleafz5x
SHA256 52bd61ba2153572260fc9b8f7eac34b613272c428e715fe6b3505f96e4eacf5d
MD5 ec9416ccf51a95a73d9cbd6a54394212
SHA1 f70b70582d3935ae4b225e7899f8e19c7983f0b7
SHA512 b0f6d5ad0b8cd3764dd05e919c18cb0508151ea967f47fc7f0a7e05cca231d0ab415ac5dee42b75c19abd99f9666d8e433cd906a947563f7e486bed1eca6bddf
SSDEEP 24576:i6K1AZg7pP732P0pgBUHZyOS2fWTkpnCW7in2JqDN0jdb00Iq8RPulQ:i6K1K+gBUcOSrSCEqDN0lnYM
TLSH
T1C575CF19E38D12E8D227D134CBA65232E7B5B81A0761BDEF165AC3192FB79D01F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec9416ccf51a95a73d9cbd6a54394212.docx.exe

File Explorer

ec9416ccf51a95a73d9cbd6a54394212.docx.exe

.exe 1.5MB

ec9416ccf51a95a73d9cbd6a54394212.docx.exe

IMPHASH d7a140ad86093e229082e6f8b7493b94
SHA256 52bd61ba2153572260fc9b8f7eac34b613272c428e715fe6b3505f96e4eacf5d
MD5 ec9416ccf51a95a73d9cbd6a54394212
SHA1 f70b70582d3935ae4b225e7899f8e19c7983f0b7
SHA512 b0f6d5ad0b8cd3764dd05e919c18cb0508151ea967f47fc7f0a7e05cca231d0ab415ac5dee42b75c19abd99f9666d8e433cd906a947563f7e486bed1eca6bddf
SSDEEP 24576:i6K1AZg7pP732P0pgBUHZyOS2fWTkpnCW7in2JqDN0jdb00Iq8RPulQ:i6K1K+gBUcOSrSCEqDN0lnYM
TLSH
T1C575CF19E38D12E8D227D134CBA65232E7B5B81A0761BDEF165AC3192FB79D01F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

680180

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DeregisterEventSource

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CreateEventExW DuplicateHandle FormatMessageW FreeLibrary GetCPInfo GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetModuleFileNameW GetProcAddress GetStdHandle GetThreadPriority LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException SetEvent SetLastError SetThreadErrorMode Sleep SleepEx VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak WaitForSingleObject GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent GetSystemTimeAsFileTime FlushProcessWriteBuffers InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoUninitialize CoWaitForMultipleHandles CoGetApartmentType CoInitializeEx

api-ms-win-crt-heap-l1-1-0

malloc calloc _set_new_mode _callnewh free

api-ms-win-crt-math-l1-1-0

log __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s _stricmp strlen strcpy strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _crt_atexit terminate abort _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _register_onexit_function __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

680KB

Virtual Size

679KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.gfx

Size

565KB

Virtual Size

565KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ec9416ccf51a95a73d9cbd6a54394212.docx.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic