2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e.exe
Size 6.9MB
Sample260730-h7whsaeq21
SHA256 2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e
MD5 d5cfb3a137e989dcb18a7f35bfbec93d
SHA1 476838ce64182c1673dd750ad764d42961709b4d
SHA512 cdb17dfe47b4f987f06217567a602c55bad5cc68d126e36b7822aee7393339fdf100c8ef0996cc4218ece7fc023703a0ac6f5d1e8a5e519526561e8e581b18eb
SSDEEP 98304:pl9st5+W0OJ5DM26Jdnffb7qcRhBBbFO8yRywF7j+i+zDM:vAt0q5DM2L8HING
TLSH
T188767B03E29581E8C06EC174835BA733FA72B8891534B75F5BE0CB212E65F60AF1E759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e.exe

File Explorer

2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e.exe

.exe 6.9MB

2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e.exe

IMPHASH 06c25835fba4e76a147b1447101e3bb2
SHA256 2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e
MD5 d5cfb3a137e989dcb18a7f35bfbec93d
SHA1 476838ce64182c1673dd750ad764d42961709b4d
SHA512 cdb17dfe47b4f987f06217567a602c55bad5cc68d126e36b7822aee7393339fdf100c8ef0996cc4218ece7fc023703a0ac6f5d1e8a5e519526561e8e581b18eb
SSDEEP 98304:pl9st5+W0OJ5DM26Jdnffb7qcRhBBbFO8yRywF7j+i+zDM:vAt0q5DM2L8HING
TLSH
T188767B03E29581E8C06EC174835BA733FA72B8891534B75F5BE0CB212E65F60AF1E759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CreateEventA CreateSemaphoreA GetHandleInformation GetProcessAffinityMask GetThreadPriority RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlUnwindEx SetEvent SetProcessAffinityMask SetThreadContext SetThreadPriority SuspendThread VirtualQuery __C_specific_handler AddVectoredExceptionHandler AreFileApisANSI CancelIo CancelIoEx CheckRemoteDebuggerPresent CloseHandle CompareStringOrdinal ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexA CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathA GetTempPathW GetThreadContext GetTickCount GetTickCount64 GetVolumeInformationW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate HeapWalk InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LockFile LockFileEx MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReadFileEx ReadProcessMemory RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetEndOfFile SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAllocEx VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx WriteProcessMemory lstrlenW GetTimeZoneInformationForYear SystemTimeToFileTime

api-ms-win-crt-convert-l1-1-0

_ultoa mbrtowc strtol strtoll strtoul strtoull wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr exp fmax log pow trunc

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _assert _beginthreadex _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _endthreadex _errno _exit _fpreset _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _fileno _setmode fclose feof ferror fflush fgets fopen fputc fputs fread fseek ftell fwrite getc ungetc

api-ms-win-crt-string-l1-1-0

_strdup isspace isxdigit mbrlen memset strcmp strcspn strlen strncmp strspn tolower wcslen

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _localtime64 _tzset

api-ms-win-crt-utility-l1-1-0

bsearch qsort

ntdll

NtCreateNamedPipeFile NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtSetInformationThread NtWriteFile RtlGetVersion RtlNtStatusToDosError

advapi32

CopySid GetLengthSid GetTokenInformation GetUserNameW IsValidSid LookupAccountSidW OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfEntry2 GetIfTable2

netapi32

NetApiBufferFree NetGetJoinInformation NetUserEnum NetUserGetInfo NetUserGetLocalGroups

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CoUninitialize PropVariantClear

oleaut32

GetErrorInfo SafeArrayAccessData SafeArrayDestroy SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

propsys

PropVariantToBSTR VariantToPropVariant

psapi

EnumProcessModulesEx GetModuleBaseNameA GetModuleFileNameExW GetModuleInformation GetPerformanceInfo

secur32

AcceptSecurityContext AcquireCredentialsHandleA ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW LsaEnumerateLogonSessions LsaFreeReturnBuffer LsaGetLogonSessionData QueryContextAttributesW

shell32

CommandLineToArgvW SHGetKnownFolderPath

user32

CreateWindowStationA GetSystemMetrics ShowWindow

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSARecv WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv select send setsockopt socket

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

195KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2a74c3c9b5664f3b3bab603b04839a4a6e43e27ecb17d756fe10ac5d8093709e.exe

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

advapi32

bcrypt

crypt32

iphlpapi

netapi32

ole32

oleaut32

pdh

powrprof

propsys

psapi

secur32

shell32

user32

ws2_32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

generic