ef4490618651a76bc4c7a544b98afd3be7724d494760170127520504de24602d[.]exe

General

Target
ef4490618651a76bc4c7a544b98afd3be7724d494760170127520504de24602d.exe
Size 721KB
Sample260731-tgxtpswang
SHA256 ef4490618651a76bc4c7a544b98afd3be7724d494760170127520504de24602d
MD5 1fb4633d2956759c7c43e054eb5f5028
SHA1 9eac9cb63bd1db25d8dd939ddeeaddb2b31c5487
SHA512 7661ead8f18c3f3e19e8abc20aecfa6835eef5b31f45ae4ae4f8ce76de6dfff2a176c6aa3b85cc52c7151dc84a780f4c01a83f55a4804b866c16c4d13efa7283
SSDEEP 12288:mYcQK5iBgANulzSzhRddhzaxp7EGiCBlp8cf26/X6/Q0Mi+CNjkfxN:s5iBzNYsnddpaxp7EGiW6026/XuMi+yg
TLSH
T1CDF4E11392E07DD5F9658B738E1FD6ECB70DF6109E69BF2922198A2F04B11B2D163312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef4490618651a76bc4c7a544b98afd3be7724d494760170127520504de24602d.exe

File Explorer

ef4490618651a76bc4c7a544b98afd3be7724d494760170127520504de24602d.exe

.exe 721KB

ef4490618651a76bc4c7a544b98afd3be7724d494760170127520504de24602d.exe

IMPHASH b9f69a119dfb935d85204ae1d9e63436
SHA256 ef4490618651a76bc4c7a544b98afd3be7724d494760170127520504de24602d
MD5 1fb4633d2956759c7c43e054eb5f5028
SHA1 9eac9cb63bd1db25d8dd939ddeeaddb2b31c5487
SHA512 7661ead8f18c3f3e19e8abc20aecfa6835eef5b31f45ae4ae4f8ce76de6dfff2a176c6aa3b85cc52c7151dc84a780f4c01a83f55a4804b866c16c4d13efa7283
SSDEEP 12288:mYcQK5iBgANulzSzhRddhzaxp7EGiCBlp8cf26/X6/Q0Mi+CNjkfxN:s5iBzNYsnddpaxp7EGiW6026/XuMi+yg
TLSH
T1CDF4E11392E07DD5F9658B738E1FD6ECB70DF6109E69BF2922198A2F04B11B2D163312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

20615

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\guva xahin bisutoxe\gipux64_yeyuy.pdb

kernel32

SetVolumeLabelA CreateFileA SearchPathW GetConsoleAliasesLengthW FindResourceW UpdateResourceA GlobalAddAtomA GetConsoleAliasA FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetConsoleAliasesA GetWindowsDirectoryA GetPriorityClass GetVolumePathNameW LoadLibraryW ReadConsoleInputA SizeofResource GetSystemWindowsDirectoryA GetConsoleAliasExesLengthW DeleteVolumeMountPointW EnumSystemCodePagesA IsProcessorFeaturePresent VerifyVersionInfoA TerminateProcess SetComputerNameExW lstrcatA GetConsoleAliasesW FillConsoleOutputCharacterA InterlockedFlushSList SetLastError GetProcAddress VirtualAlloc BackupWrite CreateNamedPipeA SetFileAttributesA PrepareTape OpenWaitableTimerA InterlockedExchangeAdd LocalAlloc GetNumberFormatW RemoveDirectoryW SetConsoleWindowInfo FoldStringW FoldStringA GlobalFindAtomW QueryMemoryResourceNotification FreeEnvironmentStringsW VirtualProtect PeekConsoleInputA GetWindowsDirectoryW GetCurrentProcessId AddConsoleAliasA GetLastError CloseHandle GetStartupInfoW RaiseException RtlUnwind GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection WriteFile GetModuleFileNameA GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW

user32

CharToOemBuffA

gdi32

GetCharABCWidthsFloatA

winhttp

WinHttpWriteData

Sharing