df4cf6f6be06bfd7eaf23bffc9c16639573228bc72fd6262352a242b5bdf2080[.]exe

General

Target
df4cf6f6be06bfd7eaf23bffc9c16639573228bc72fd6262352a242b5bdf2080.exe
Size 808KB
Sample260719-sjhbcsfz21
SHA256 df4cf6f6be06bfd7eaf23bffc9c16639573228bc72fd6262352a242b5bdf2080
MD5 7af338c461c5069d1e0fe91d95770b96
SHA1 49975f296e3e7b5c6ee97c6d5f0cd4a8e9305f08
SHA512 a4f6874390a3f7431797e42d4a51a770d82e33961e9456b01c43093f4cea18c9d1b6addcc972d73f06ffc63b4da479f5a7cedcb33d0ca025bebd96da71d9380f
SSDEEP 12288:LZaij2Ng3pCC1gvH8wvYxCnRfAmtRyxwwRrrWKWiYzK5fa+aqRx/f:1r9H/xCnRfrqgXiYmdPzv
TLSH
T1F70512113BB0C0B6D1752130A969E2D36E2E7B7199B1E8577789862C3C217C27D7BF0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df4cf6f6be06bfd7eaf23bffc9c16639573228bc72fd6262352a242b5bdf2080.exe

File Explorer

df4cf6f6be06bfd7eaf23bffc9c16639573228bc72fd6262352a242b5bdf2080.exe

.exe 808KB

df4cf6f6be06bfd7eaf23bffc9c16639573228bc72fd6262352a242b5bdf2080.exe

IMPHASH 1f8aedd2ed2c23ee27040330b035e00c
SHA256 df4cf6f6be06bfd7eaf23bffc9c16639573228bc72fd6262352a242b5bdf2080
MD5 7af338c461c5069d1e0fe91d95770b96
SHA1 49975f296e3e7b5c6ee97c6d5f0cd4a8e9305f08
SHA512 a4f6874390a3f7431797e42d4a51a770d82e33961e9456b01c43093f4cea18c9d1b6addcc972d73f06ffc63b4da479f5a7cedcb33d0ca025bebd96da71d9380f
SSDEEP 12288:LZaij2Ng3pCC1gvH8wvYxCnRfAmtRyxwwRrrWKWiYzK5fa+aqRx/f:1r9H/xCnRfrqgXiYmdPzv
TLSH
T1F70512113BB0C0B6D1752130A969E2D36E2E7B7199B1E8577789862C3C217C27D7BF0A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

1007616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\rijevam.pdb

kernel32

ZombifyActCtx GetEnvironmentStringsW GetConsoleAliasesA GetEnvironmentStrings GetPrivateProfileIntA WideCharToMultiByte LoadLibraryW SetVolumeMountPointA LeaveCriticalSection HeapValidate WriteConsoleW GetAtomNameW ReplaceFileA SetLastError GetProcAddress AttachConsole SetFilePointer BeginUpdateResourceW SetStdHandle LoadLibraryA LocalAlloc AddVectoredExceptionHandler WriteProfileSectionW GetModuleFileNameA GetDefaultCommConfigA SetConsoleTitleW GetConsoleTitleW SetCalendarInfoA LocalFree FindFirstChangeNotificationW VirtualAlloc EnumResourceNamesW CreateFileA GetConsoleOutputCP HeapAlloc GetCommandLineA GetStartupInfoA RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree DeleteCriticalSection EnterCriticalSection VirtualFree HeapReAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle SetHandleCount GetFileType CloseHandle FreeEnvironmentStringsA FreeEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode MultiByteToWideChar FlushFileBuffers HeapSize GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW WriteConsoleA

user32

ClientToScreen

advapi32

BackupEventLogA

winhttp

WinHttpSetTimeouts

Sharing