f7406f510410049b863e7998ee56ed1767400ddce304fcd45aef7a89706d50ee[.]exe

General

Target
f7406f510410049b863e7998ee56ed1767400ddce304fcd45aef7a89706d50ee.exe
Size 738KB
Sample260731-ntabaaswat
SHA256 f7406f510410049b863e7998ee56ed1767400ddce304fcd45aef7a89706d50ee
MD5 5b59cff2798b4a245c53ce68055804a4
SHA1 d6677c9baac718bc8f7c4075ed0c6f6468fa0954
SHA512 7cf045d80c03e2d7b03c5a14832801800e461d8cd63e7fa7258abfb85df61c69facc984cac706feb2a2364a1188c092f09bfbaac9fc5ddc2a4f9ff594b799ca6
SSDEEP 12288:SuqB1BEqUFxtNBWgsljskzvWyka+5EN1WSVheIYCgl7mLBo:SPNUTH8ZBzvDk15QISV1YCk6Vo
TLSH
T14FF4121136D2C037F57315308E7086B5862BBCA28AB5D9CF37D552AA4FE62D1CE0D3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f7406f510410049b863e7998ee56ed1767400ddce304fcd45aef7a89706d50ee.exe

File Explorer

f7406f510410049b863e7998ee56ed1767400ddce304fcd45aef7a89706d50ee.exe

.exe 738KB

f7406f510410049b863e7998ee56ed1767400ddce304fcd45aef7a89706d50ee.exe

IMPHASH 9fa45476e477c6919d1122378d8053e3
SHA256 f7406f510410049b863e7998ee56ed1767400ddce304fcd45aef7a89706d50ee
MD5 5b59cff2798b4a245c53ce68055804a4
SHA1 d6677c9baac718bc8f7c4075ed0c6f6468fa0954
SHA512 7cf045d80c03e2d7b03c5a14832801800e461d8cd63e7fa7258abfb85df61c69facc984cac706feb2a2364a1188c092f09bfbaac9fc5ddc2a4f9ff594b799ca6
SSDEEP 12288:SuqB1BEqUFxtNBWgsljskzvWyka+5EN1WSVheIYCgl7mLBo:SPNUTH8ZBzvDk15QISV1YCk6Vo
TLSH
T14FF4121136D2C037F57315308E7086B5862BBCA28AB5D9CF37D552AA4FE62D1CE0D3A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile LocalCompact CreateHardLinkA GetModuleHandleW GetProcessHeap EnumResourceTypesA GlobalAlloc GetSystemDirectoryW LoadLibraryW IsProcessInJob AssignProcessToJobObject IsBadWritePtr GetLastError SetLastError GetProcAddress IsBadHugeWritePtr VerLanguageNameA FindClose LoadLibraryA SetConsoleCtrlHandler AddAtomW CreateEventW GlobalHandle GetModuleFileNameA GetOEMCP GlobalUnWire HeapSetInformation EnumResourceNamesA GetCurrentThreadId Module32NextW GetDiskFreeSpaceExA ReadConsoleInputW WriteConsoleW CloseHandle FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle SetFilePointer HeapReAlloc WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCommandLineW GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW IsProcessorFeaturePresent HeapCreate ReadFile UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW

user32

ChangeMenuW GetMessageExtraInfo CharUpperBuffA SetCursorPos SetUserObjectSecurity SetCaretPos GetCaretBlinkTime SetClipboardViewer

Name

.text

Size

644KB

Virtual Size

643KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

28.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.helal

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cawizur

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pogazad

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f7406f510410049b863e7998ee56ed1767400ddce304fcd45aef7a89706d50ee.exe

kernel32

user32

generic