3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe
Size 2.5MB
Sample260726-c2964aycnf
SHA256 3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b
MD5 55ef16c6bc615a79c09aebdfb6077b39
SHA1 ecce12d8ec9bcb7cbab627c3539e7eb199bc4bb3
SHA512 b7c4acb0bcfd6d26c54bbe992e4def4ba50e00809b133ad8a66053a2cc08208e1c689fe1ce0b2b7775c1f212fbe823b2651202b0888bca900cf46ccc203d7178
SSDEEP 49152:IKkl/M0EOFreudY6+idOP3SmT13QhkMrapZKAZc677HB1+vch5:IKa/3EOFreodOPJZORSZKA9XBU
TLSH
T12CC512842F8A25FFD28BC7788151680FB9677BE3BD23B449678565090E327FA0FB2154
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe

File Explorer

3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe

.exe 2.5MB

3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe

IMPHASH 5a5081b1176ce07a5e6ebc3dbd7a5ce3
SHA256 3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b
MD5 55ef16c6bc615a79c09aebdfb6077b39
SHA1 ecce12d8ec9bcb7cbab627c3539e7eb199bc4bb3
SHA512 b7c4acb0bcfd6d26c54bbe992e4def4ba50e00809b133ad8a66053a2cc08208e1c689fe1ce0b2b7775c1f212fbe823b2651202b0888bca900cf46ccc203d7178
SSDEEP 49152:IKkl/M0EOFreudY6+idOP3SmT13QhkMrapZKAZc677HB1+vch5:IKa/3EOFreodOPJZORSZKA9XBU
TLSH
T12CC512842F8A25FFD28BC7788151680FB9677BE3BD23B449678565090E327FA0FB2154
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5498366

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitializeCriticalSectionEx lstrlenA CreateMutexA WaitForSingleObject lstrcatA GetModuleHandleA SetCurrentDirectoryA Sleep GetModuleHandleExA GetFileAttributesA GetBinaryTypeA QueryFullProcessImageNameA GetSystemDirectoryA GlobalAlloc lstrcpyA SetFileAttributesA VerSetConditionMask WideCharToMultiByte VerifyVersionInfoW GetSystemTimeAsFileTime CreateEventA HeapFree HeapAlloc GetProcAddress lstrcpynA GetProcessHeap AreFileApisANSI TryEnterCriticalSection HeapCreate EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection FindClose SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId SystemTimeToFileTime FreeLibrary GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers WriteConsoleW CloseHandle CreateFileA GetLastError CreateFileW SetFilePointer WriteFile GetFullPathNameA ReadFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW CreateDirectoryW FindFirstFileExW FindNextFileW SetFilePointerEx GetFileInformationByHandleEx QueryPerformanceFrequency LCMapStringEx EncodePointer DecodePointer GetCPInfo GetStringTypeW SetLastError GetCurrentThread GetThreadTimes RtlUnwindEx InterlockedPushEntrySList RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileType ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle GetConsoleMode ReadConsoleW GetConsoleOutputCP SetStdHandle CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx GetTimeZoneInformation IsValidCodePage GetACP RtlUnwind HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

CharNextA

advapi32

RegCloseKey RegCreateKeyExA RegSetValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation CryptReleaseContext

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

Name

.text

Size

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

./7zip/7

Size

Virtual Size

459KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

./7zip/7

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

./7zip/7

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

50KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3c405151d59ea76d411aa6898792373cd563324fa3c19afd67f9a0236ab7358b.exe

kernel32

user32

advapi32

shell32

ole32

generic