microslopdebloater[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
microslopdebloater.exe
Size 475KB
Sample260718-an1pdset8t
SHA256 cf860935a6872927f7720b555011ed4d0dced9a254d47fd83179ca7f719b3af0
MD5 afd76bf365261ad684ba6176e19d532e
SHA1 c899f837c2d8522def41c9d2e6319a57317b5f91
SHA512 ddd67381b45a73e1ef0379f8cbeb73b5a4d744cd7e16d05608566672df52cbf9b95380c8d2524c5f4dee3d3b0bb5636207202e5d0684ab1895a1a388c8394292
SSDEEP 12288:Zo5Qg0aWoLtKc1PNzhlURLedWTAgNIFeTw7f:ZngIoPPdf
TLSH
T11FA47CC3F68005F5E836D93AC4626D22A1777D7A6B10D9E7439476236F336D3983AA03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
microslopdebloater.exe

File Explorer

microslopdebloater.exe

.exe 475KB

microslopdebloater.exe

IMPHASH 0d493abb639febc790776b9014760d8a
SHA256 cf860935a6872927f7720b555011ed4d0dced9a254d47fd83179ca7f719b3af0
MD5 afd76bf365261ad684ba6176e19d532e
SHA1 c899f837c2d8522def41c9d2e6319a57317b5f91
SHA512 ddd67381b45a73e1ef0379f8cbeb73b5a4d744cd7e16d05608566672df52cbf9b95380c8d2524c5f4dee3d3b0bb5636207202e5d0684ab1895a1a388c8394292
SSDEEP 12288:Zo5Qg0aWoLtKc1PNzhlURLedWTAgNIFeTw7f:ZngIoPPdf
TLSH
T11FA47CC3F68005F5E836D93AC4626D22A1777D7A6B10D9E7439476236F336D3983AA03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACleanup inet_ntop WSAStartup

wininet

InternetOpenUrlA InternetReadFile InternetOpenA InternetCloseHandle

shell32

ShellExecuteExW ShellExecuteA

wlanapi

WlanGetProfile WlanGetProfileList WlanEnumInterfaces WlanFreeMemory WlanOpenHandle WlanCloseHandle

advapi32

LookupPrivilegeNameA GetTokenInformation AdjustTokenPrivileges OpenProcessToken GetUserNameA RegCloseKey RegCreateKeyExA RegEnumKeyExA RegOpenKeyExA CredFree CredEnumerateA RegSetValueExA RegSaveKeyA RegQueryValueExA LookupPrivilegeValueA

iphlpapi

GetAdaptersAddresses GetIpForwardTable GetIpNetTable

gdi32

CreateCompatibleDC BitBlt DeleteObject GetDIBits SelectObject DeleteDC CreateCompatibleBitmap

user32

GetDC GetSystemMetrics SystemParametersInfoA ReleaseDC

kernel32

MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW GetCPInfo SetStdHandle GetStringTypeW GetProcessHeap IsValidCodePage GetOEMCP GetACP SetEnvironmentVariableW FlushFileBuffers CreateFileW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW SetConsoleTitleA FindNextFileW FindFirstFileExW GetFileSizeEx GetConsoleOutputCP GetStdHandle ExpandEnvironmentStringsA SetCurrentDirectoryA CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA RemoveDirectoryA CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetCurrentProcess ExitProcess CreateThread CreateProcessA GlobalMemoryStatusEx GetSystemInfo GetVersionExA GetModuleFileNameA GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock GlobalFree CopyFileA GetComputerNameA FileTimeToSystemTime WideCharToMultiByte ReadConsoleInputA FlushConsoleInputBuffer CreateToolhelp32Snapshot Process32First Process32Next Module32First Module32Next QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW SetFilePointerEx RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader ReadFile WriteFile TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent HeapFree HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetExitCodeProcess CreateProcessW GetFileAttributesExW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType GetConsoleMode ReadConsoleW

Name

.text

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

264KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

microslopdebloater.exe

ws2_32

wininet

shell32

wlanapi

advapi32

iphlpapi

gdi32

user32

kernel32

generic