Endermanch@7ev3n[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
[email protected]
Size 315KB
Sample260808-py2rrsfm21
SHA256 7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5
MD5 9f8bc96c96d43ecb69f883388d228754
SHA1 61ed25a706afa2f6684bb4d64f69c5fb29d20953
SHA512 550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6
SSDEEP 6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXv:BswRSslz0P1OdFXJlJ8buXv
TLSH
T183643A54BC8840ADC03693F00AA2C6A5633EF633371569ABBFDD53781E255E1E733A16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
[email protected]

File Explorer

[email protected]

.exe 315KB

[email protected]

IMPHASH 008aca28b7c001acc5e0ab32fabaad84
SHA256 7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5
MD5 9f8bc96c96d43ecb69f883388d228754
SHA1 61ed25a706afa2f6684bb4d64f69c5fb29d20953
SHA512 550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6
SSDEEP 6144:BswDdb2MemnBVlz0SoVbO4A6OA4Trl28TyT6llY1/I8cWJWlfTXv:BswRSslz0P1OdFXJlJ8buXv
TLSH
T183643A54BC8840ADC03693F00AA2C6A5633EF633371569ABBFDD53781E255E1E733A16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68453

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

J:\Win32Project9\Release\Win32Project9.pdb

kernel32

GetCurrentProcess ExitThread SetEndOfFile CreateFileW HeapSize WriteConsoleW ReadConsoleW SetStdHandle FindFirstFileExW FindClose GetProcAddress GetCommandLineW GetCommandLineA GetProcessHeap SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetFilePointerEx ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers WinExec CreateProcessA GetStartupInfoA GetModuleFileNameW CopyFileA GetFileAttributesA GetModuleFileNameA FindNextFileW GetLocalTime FindFirstFileW CreateThread GetModuleHandleW Sleep GetLogicalDrives VerifyVersionInfoW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileAttributesExW GetExitCodeProcess WaitForSingleObject GetFileType UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent CloseHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo GetLastError FreeLibrary LoadLibraryExW RaiseException RtlUnwind MoveFileExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP HeapAlloc HeapReAlloc HeapFree VerSetConditionMask

user32

ShowWindow SendMessageW FindWindowW DrawTextA CallNextHookEx GetAsyncKeyState DefWindowProcW PostQuitMessage DestroyWindow KillTimer InvalidateRect SetTimer EndPaint SetWindowsHookExW DrawTextW BeginPaint GetSystemMetrics ShowCursor DispatchMessageW TranslateMessage GetMessageW SetForegroundWindow SetWindowLongW SetWindowPos CreateWindowExW RegisterClassExW LoadCursorW

gdi32

MoveToEx CreatePen DeleteObject SetTextColor SetBkMode SelectObject CreateFontIndirectW CreateSolidBrush LineTo

advapi32

SystemFunction036 GetUserNameA RegCloseKey RegQueryValueExW RegOpenKeyExW GetUserNameW

shell32

ord680

wininet

InternetOpenW InternetOpenUrlW InternetReadFile InternetCloseHandle

netapi32

NetUserGetInfo

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

[email protected]

kernel32

user32

gdi32

advapi32

shell32

wininet

netapi32

generic