65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f.exe
Size 2.8MB
Sample260713-vx83caew9x
SHA256 65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f
MD5 3b483dce1793ec320b176f90492e1731
SHA1 c2ca3ffb1274c7c5898e84bac2e52e75d317cbb2
SHA512 e82171f4e8ee64c2947f7103698ccfe2a2d3aebdea95f12afeaf5c488f4d2280094c4d1a359ec4f97830b89ed5bf29a9c9cc1b74f476faf7d2615bfd2e4708d8
SSDEEP 24576:Tvf8RTEKbJYZoYS3rFEMOwgPR/r+0OQqQkyn+Y81nAc+Ec0xMkl81sU3Ao1poM7Z:bf8RzbJY7YAPtoQqA8nAbpoM7oq7Hj
TLSH
T141D5F94369DB0DEAEDD27BB861C35335E774FD318A291F2AA704C63129536C4AE1EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f.exe

File Explorer

65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f.exe

.exe 2.8MB

65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f.exe

IMPHASH ff82b6d127432c753f4c23bd2b2cef8e
SHA256 65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f
MD5 3b483dce1793ec320b176f90492e1731
SHA1 c2ca3ffb1274c7c5898e84bac2e52e75d317cbb2
SHA512 e82171f4e8ee64c2947f7103698ccfe2a2d3aebdea95f12afeaf5c488f4d2280094c4d1a359ec4f97830b89ed5bf29a9c9cc1b74f476faf7d2615bfd2e4708d8
SSDEEP 24576:Tvf8RTEKbJYZoYS3rFEMOwgPR/r+0OQqQkyn+Y81nAc+Ec0xMkl81sU3Ao1poM7Z:bf8RzbJY7YAPtoQqA8nAbpoM7oq7Hj
TLSH
T141D5F94369DB0DEAEDD27BB861C35335E774FD318A291F2AA704C63129536C4AE1EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4342

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FindResourceA FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LockResource MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _close _commode _endthreadex _errno _fdopen _fileno _fmode _fstat64 _initterm _lseeki64 _mkdir _onexit _read _setjmp _strdup _strnicmp _ultoa _vsnprintf _vsnwprintf _wfopen _write abort calloc exit fclose fflush fgetwc fopen fprintf fputc fputs free fwrite getc isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf realloc setlocale setvbuf signal strcmp strcoll strerror strftime strlen strncmp strxfrm towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

shell32

SHGetFolderPathA

Name

.text

Size

748KB

Virtual Size

747KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

369KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

512B

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

65a3bf90bb49d29d3970b75e5b6e16527c135e0784bc93a23b8f206e906db79f.exe

kernel32

msvcrt

shell32

generic