fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa[.]exe

General

Target
fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa.exe
Size 347KB
Sample260729-pfy8xstdpe
SHA256 fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa
MD5 5f338809e1174ab79e5063ccad569ebf
SHA1 e7c10454339bfcd3e7f35183dac4c61e642f848f
SHA512 8c054b6893c77cf4772b3504485ae941355d5fd153f497b91822a4edf7f3f9158d1a499954ed9de64d32a2fd92d99f2234c33f5e6a318d85a52ca7c3b66732ed
SSDEEP 6144:/6gK/APsjrh+9bETi0zMThBjH5RNLBFwCJKq9RKa6wVF1u1+gbu11MUrjFzNLWWE:yg8jrEtmiIMThBjHdBFQqjK2VF1uIPMi
TLSH
T1D574CFD5E75134E5F25B89708EB34F4396223E0F8A21D27B1295450FAE63FC61E34BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa.exe

File Explorer

fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa.exe

.dll 347KB

fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa.exe

IMPHASH cc17bcc7fe575a59b90e88841fe76dbc
SHA256 fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa
MD5 5f338809e1174ab79e5063ccad569ebf
SHA1 e7c10454339bfcd3e7f35183dac4c61e642f848f
SHA512 8c054b6893c77cf4772b3504485ae941355d5fd153f497b91822a4edf7f3f9158d1a499954ed9de64d32a2fd92d99f2234c33f5e6a318d85a52ca7c3b66732ed
SSDEEP 6144:/6gK/APsjrh+9bETi0zMThBjH5RNLBFwCJKq9RKa6wVF1u1+gbu11MUrjFzNLWWE:yg8jrEtmiIMThBjHdBFQqjK2VF1uIPMi
TLSH
T1D574CFD5E75134E5F25B89708EB34F4396223E0F8A21D27B1295450FAE63FC61E34BA8
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6436

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessW GetSystemInfo DisableThreadLibraryCalls CloseHandle lstrcpyW lstrcatW lstrlenW WriteConsoleW GetTempPathW WriteFile DeleteFileW GetModuleFileNameW CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

advapi32

RegDeleteKeyW RegCreateKeyExW RegCloseKey RegSetValueExW

Sharing