Y8LIh1O5otkaA8FogfS9CT_qshb[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Y8LIh1O5otkaA8FogfS9CT_qshb.exe
Size 22.0MB
Sample260730-hd4bjasene
SHA256 11918d9589fbe67485c0c208372c1767c4abe82c6d94122bf239c1579651d3ee
MD5 626bc5c22c662b5d5b982d6a0312101d
SHA1 aaf0cf789fc2a5f957861ed85865add83510a1a0
SHA512 2dd33ce2bc37c6b4438c8b1955378943bab1edfe9845ba55fee7266dbd4bfd6e44e64f13dfe256f62c7ce020bccdbdf1679cb67d6e856f4dfb398bb54c23f656
SSDEEP 393216:BilhpFAl5nezJIdPAsKiuZqi+odepneorCTMD+R0/qflLg2LX0DGnKJeekA:BeclczJISszmaodelBrOLgu0qnKJeek
TLSH
T1CE3733D43AD0D26DC09AC435C28787F5F0936FD89EBA941BBFC609122570B96CCB2979
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Y8LIh1O5otkaA8FogfS9CT_qshb.exe

File Explorer

Y8LIh1O5otkaA8FogfS9CT_qshb.exe

.exe 22.0MB

Y8LIh1O5otkaA8FogfS9CT_qshb.exe

IMPHASH 07dcad68214ed261baeccc27a054c929
SHA256 11918d9589fbe67485c0c208372c1767c4abe82c6d94122bf239c1579651d3ee
MD5 626bc5c22c662b5d5b982d6a0312101d
SHA1 aaf0cf789fc2a5f957861ed85865add83510a1a0
SHA512 2dd33ce2bc37c6b4438c8b1955378943bab1edfe9845ba55fee7266dbd4bfd6e44e64f13dfe256f62c7ce020bccdbdf1679cb67d6e856f4dfb398bb54c23f656
SSDEEP 393216:BilhpFAl5nezJIdPAsKiuZqi+odepneorCTMD+R0/qflLg2LX0DGnKJeekA:BeclczJISszmaodelBrOLgu0qnKJeek
TLSH
T1CE3733D43AD0D26DC09AC435C28787F5F0936FD89EBA941BBFC609122570B96CCB2979
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27165212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipGetImageEncodersSize

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

WSAEventSelect

iphlpapi

if_nametoindex

kernel32

GetProcAddress

user32

wsprintfW

gdi32

CreateCompatibleDC

advapi32

CryptDestroyHash

shell32

ShellExecuteExW

ole32

CreateStreamOnHGlobal

msvcp140

?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

imm32

ImmSetCompositionWindow

vcruntime140

__current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_exit

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

_ldclass

api-ms-win-crt-heap-l1-1-0

_aligned_malloc

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcmp

crypt32

CertEnumCertificatesInStore

Name

.text

Size

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

778KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

685KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gYO

Size

Virtual Size

17.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.B4E

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.b,D

Size

22.0MB

Virtual Size

22.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

10KB

Virtual Size

893KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Y8LIh1O5otkaA8FogfS9CT_qshb.exe

gdiplus

d3d11

ws2_32

iphlpapi

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

d3dcompiler_47

dwmapi

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

crypt32

generic