49f59cd7879fcb6e138d11848bb8ec897574ad02195f53db51f73c7a3f4c8e00[.]exe

General

Target
49f59cd7879fcb6e138d11848bb8ec897574ad02195f53db51f73c7a3f4c8e00.exe
Size 788KB
Sample260726-dxfblacf59
SHA256 49f59cd7879fcb6e138d11848bb8ec897574ad02195f53db51f73c7a3f4c8e00
MD5 89662c80a81d195cdca6cd68802a6c86
SHA1 bd32195a714e55aa19682078d3aa0ea0bccba4a6
SHA512 c23404aba9322acae630da8a263b62687182124172a934265b1bbbdf653ae7e5933cbd252f3e75d582951870248261d75825b2c181e088d66d04e542235f95eb
SSDEEP 12288:gjcGhibCavuW8ISgi5mSaawzZrJyEDcGCkcseUDUNIc0f4fEsK:gHhib5+ph7+ZrJrAc7eBNh8sK
TLSH
T19905F1037192FF77D55587718929C6B876EEB8618B012BCB32556F6B18312E3DAF2302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49f59cd7879fcb6e138d11848bb8ec897574ad02195f53db51f73c7a3f4c8e00.exe

File Explorer

49f59cd7879fcb6e138d11848bb8ec897574ad02195f53db51f73c7a3f4c8e00.exe

.exe 788KB

49f59cd7879fcb6e138d11848bb8ec897574ad02195f53db51f73c7a3f4c8e00.exe

IMPHASH 40be65705a95a43e6733e98c1ce5e92b
SHA256 49f59cd7879fcb6e138d11848bb8ec897574ad02195f53db51f73c7a3f4c8e00
MD5 89662c80a81d195cdca6cd68802a6c86
SHA1 bd32195a714e55aa19682078d3aa0ea0bccba4a6
SHA512 c23404aba9322acae630da8a263b62687182124172a934265b1bbbdf653ae7e5933cbd252f3e75d582951870248261d75825b2c181e088d66d04e542235f95eb
SSDEEP 12288:gjcGhibCavuW8ISgi5mSaawzZrJyEDcGCkcseUDUNIc0f4fEsK:gHhib5+ph7+ZrJrAc7eBNh8sK
TLSH
T19905F1037192FF77D55587718929C6B876EEB8618B012BCB32556F6B18312E3DAF2302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

40013

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\goludenub.pdb

kernel32

VirtualQuery GetCommState InterlockedDecrement CreateJobObjectW InterlockedCompareExchange SetEvent GetProcessPriorityBoost GetModuleHandleW GetConsoleTitleA ReadConsoleW GetWindowsDirectoryA InitializeCriticalSection GlobalAlloc IsValidLocale FatalAppExitW IsBadCodePtr GetSystemWindowsDirectoryA GetVersionExW GlobalFlags FindNextVolumeW GetConsoleAliasW ReplaceFileW IsDBCSLeadByte CreateActCtxA GetTempPathW AllocConsole GetLogicalDriveStringsA OpenMutexW GetLastError SetLastError GetProcAddress AttachConsole VirtualAlloc GetTempFileNameA LoadLibraryA DnsHostnameToComputerNameA CreateFileMappingW OpenEventA VirtualLock GetTapeParameters GetModuleFileNameA GetDefaultCommConfigA FindFirstVolumeMountPointA GetModuleHandleA GetConsoleTitleW WaitForDebugEvent ScrollConsoleScreenBufferA _lopen FindAtomW AddConsoleAliasA ReadConsoleOutputCharacterW EnumCalendarInfoExA GetLocaleInfoA GetConsoleAliasesLengthW GetDateFormatW lstrlenA SetThreadContext GetStringTypeExA WideCharToMultiByte InterlockedIncrement InterlockedExchange MultiByteToWideChar Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA GetCPInfo RtlUnwind RaiseException LCMapStringW LCMapStringA GetStringTypeW HeapCreate VirtualFree HeapReAlloc ExitProcess WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID EnumSystemLocalesA InitializeCriticalSectionAndSpinCount GetLocaleInfoW

gdi32

GetCharWidthI GetCharABCWidthsI GetCharABCWidthsFloatW GetCharWidthA EnumFontsA

Sharing