undetek-v10[.]41[.]exe

General

Target
undetek-v10.41.exe
Size 247KB
Sample260724-nv3dfsdm4v
SHA256 e70389da0f9d1c9f0675caa6d5bf913b60cbd90e72913517416bc26103729643
MD5 8f002fe8f7a974f5e5e3dc76c4e7ad6b
SHA1 8510a6961314d19ba116783abca7b22730e3971c
SHA512 5d8c228066fc51cf8c3b203047e386e808eba16a197c3b01bf8d52bdc9908ec5c8171b7168eb3f2f3ec7a8903211d49d2173d5a7c99b157180cb74855cc72a4a
SSDEEP 3072:LSnoZnf5W3Cl/yHtu3hWLgNS3rTK50aqdpzL2lF91EpkyL3d/z370+oloaya:oY83Cl/203hSgN2TKyd92r9g1zLWVya
TLSH
T16C44390A77A994F5D4B2D639C94229BAF6B1BC05837193DF03903927AF336E1D839391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
undetek-v10.41.exe

File Explorer

undetek-v10.41.exe

.exe 247KB

undetek-v10.41.exe

IMPHASH 96f0a629988571a51f50bbbdf2805812
SHA256 e70389da0f9d1c9f0675caa6d5bf913b60cbd90e72913517416bc26103729643
MD5 8f002fe8f7a974f5e5e3dc76c4e7ad6b
SHA1 8510a6961314d19ba116783abca7b22730e3971c
SHA512 5d8c228066fc51cf8c3b203047e386e808eba16a197c3b01bf8d52bdc9908ec5c8171b7168eb3f2f3ec7a8903211d49d2173d5a7c99b157180cb74855cc72a4a
SSDEEP 3072:LSnoZnf5W3Cl/yHtu3hWLgNS3rTK50aqdpzL2lF91EpkyL3d/z370+oloaya:oY83Cl/203hSgN2TKyd92r9g1zLWVya
TLSH
T16C44390A77A994F5D4B2D639C94229BAF6B1BC05837193DF03903927AF336E1D839391
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

42996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadProcessMemory WriteProcessMemory GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot VirtualProtectEx Process32Next WriteConsoleW CreateFileW HeapReAlloc HeapSize VirtualAllocEx GetTickCount64 OpenProcess CreateRemoteThread Sleep WaitForSingleObject GetLastError Process32First CloseHandle SetFilePointerEx GetFileSizeEx ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RtlUnwind

user32

GetAsyncKeyState SendInput

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteKeyA RegCreateKeyExA RegCloseKey RegSetValueExW

ws2_32

socket WSAGetLastError recv connect closesocket WSAStartup WSACleanup freeaddrinfo getaddrinfo send

Resubmissions

Sharing