4f37xzs[.]exe | Triage™

General

Target
4f37xzs.exe
Size 140KB
Sample260809-bwemkagc26
SHA256 5c7f3a0a3732498b07d161a1878396f439326ee62d51726b35845349214e8951
MD5 44cda611be3f0f70f8f68863ae98c832
SHA1 2269418de3bb2b0a7f77a5704025aab2e98bfeae
SHA512 34c92e7813fc5b6555edd07e87d4f29af2d2cf6f956daf21768a3fb6999b7748643b691adf686bebebfdec8b2b3b8bc5ad5f8a5c948e5e6dcafeb6f53ba20f09
SSDEEP 3072:Qn+4slZnh+KGLnAPV0jBCyBppUCc7rVOUHq:8MhFyddCQppUChU
TLSH
T109E36C57B3A530F9D567C238C9611A46E7B2B8320720CB6F13A846766F273909D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f37xzs.exe

File Explorer

4f37xzs.exe

.exe 140KB

4f37xzs.exe

IMPHASH d0ade7971105e074bac89afe21fadae6
SHA256 5c7f3a0a3732498b07d161a1878396f439326ee62d51726b35845349214e8951
MD5 44cda611be3f0f70f8f68863ae98c832
SHA1 2269418de3bb2b0a7f77a5704025aab2e98bfeae
SHA512 34c92e7813fc5b6555edd07e87d4f29af2d2cf6f956daf21768a3fb6999b7748643b691adf686bebebfdec8b2b3b8bc5ad5f8a5c948e5e6dcafeb6f53ba20f09
SSDEEP 3072:Qn+4slZnh+KGLnAPV0jBCyBppUCc7rVOUHq:8MhFyddCQppUChU
TLSH
T109E36C57B3A530F9D567C238C9611A46E7B2B8320720CB6F13A846766F273909D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetLastError OpenProcess ReadProcessMemory CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WriteConsoleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode CreateFileW ReadFile ReadConsoleW GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc SetEndOfFile RtlUnwind

Sharing