dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0[.]exe

General

Target
dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
Size 833KB
Sample260809-marksadm51
SHA256 dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0
MD5 65ea6b27d5c0223105de8f753687f38e
SHA1 66cdf62d3b8b97582acf28fa97eff4bb68d80866
SHA512 ff92e8a878b5f0200e4ba42b5a98fb88a4b4ddb03fe88116eeb4e9d8a0df2711f4edd7b3e7e4ae8c5d1c9ef0fcdd590e21fee0d0e32a42d110ca2cf46db90dc3
SSDEEP 24576:4lgpA7BAcIG9UDWk81NnMlgdNOS5rGJW9:exIG9rk81NOgd0S5qs9
TLSH
T144050250BBA0D03DE0B751F47979D7A8B52D39B05B2460CF12E22ADF5634AE0ECB125B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

File Explorer

dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

.exe 833KB

dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

IMPHASH d626a2a864a52e91dc5f85b5e98029ae
SHA256 dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0
MD5 65ea6b27d5c0223105de8f753687f38e
SHA1 66cdf62d3b8b97582acf28fa97eff4bb68d80866
SHA512 ff92e8a878b5f0200e4ba42b5a98fb88a4b4ddb03fe88116eeb4e9d8a0df2711f4edd7b3e7e4ae8c5d1c9ef0fcdd590e21fee0d0e32a42d110ca2cf46db90dc3
SSDEEP 24576:4lgpA7BAcIG9UDWk81NnMlgdNOS5rGJW9:exIG9rk81NOgd0S5qs9
TLSH
T144050250BBA0D03DE0B751F47979D7A8B52D39B05B2460CF12E22ADF5634AE0ECB125B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

1015808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\hinunarusu-piloce.pdb

kernel32

SetLocaleInfoA FindNextVolumeW GetNamedPipeHandleStateW FileTimeToSystemTime EnumResourceTypesW EnumResourceNamesW FillConsoleOutputCharacterW GetTimeZoneInformation TerminateProcess SetEvent FindNextFileA GetCompressedFileSizeA CopyFileExW BuildCommDCBW VerifyVersionInfoW FreeResource SetLastError GetVersionExW ReadConsoleOutputCharacterA SetDefaultCommConfigA VerLanguageNameA EscapeCommFunction WritePrivateProfileStructW FreeEnvironmentStringsA CreateTimerQueue FindNextVolumeMountPointW GetWriteWatch WriteConsoleInputA SetComputerNameExA AddAtomW InitAtomTable GetThreadPriority CallNamedPipeW GetDriveTypeW BuildCommDCBAndTimeoutsW VirtualProtect LoadLibraryW GlobalAlloc InterlockedExchange FindFirstChangeNotificationA VerifyVersionInfoA FormatMessageA SetDllDirectoryW GetModuleHandleA WritePrivateProfileStringA GetUserDefaultLCID GlobalUnfix GetStartupInfoW GetSystemWow64DirectoryW CopyFileA GetLastError DebugBreak SetConsoleCursorInfo SetCalendarInfoW SetConsoleScreenBufferSize ContinueDebugEvent InterlockedExchangeAdd WriteProfileSectionA GetACP GetPrivateProfileStringW CreateActCtxA GetConsoleAliasA OutputDebugStringW EnumResourceTypesA lstrlenA ReadConsoleW WriteConsoleW DeleteCriticalSection GlobalWire FreeEnvironmentStringsW ConvertFiberToThread lstrcatA EnumCalendarInfoA SetThreadAffinityMask LockFile VerSetConditionMask GetConsoleCP GetProfileStringA CreateIoCompletionPort AllocConsole GlobalGetAtomNameA SetComputerNameA GetConsoleAliasExesLengthW WriteConsoleInputW CreateMailslotW GetCommState MoveFileWithProgressW GetSystemTimeAdjustment _hread _lopen EnumSystemLocalesW GetConsoleAliasExesLengthA MoveFileA ResetWriteWatch EnumDateFormatsW DeleteAtom GetSystemWindowsDirectoryA GetComputerNameA FindFirstVolumeW CancelDeviceWakeupRequest AreFileApisANSI OpenWaitableTimerA OpenFileMappingA SetProcessAffinityMask GetConsoleAliasesLengthA GetProcessShutdownParameters FindNextVolumeMountPointA WriteConsoleOutputCharacterA GetNumberFormatA GetConsoleAliasExesA GetBinaryTypeW GetCurrentActCtx BuildCommDCBAndTimeoutsA GetSystemWindowsDirectoryW LoadLibraryA GetModuleHandleW Sleep InterlockedIncrement InterlockedDecrement GetProcAddress ExitProcess DeleteFileA RaiseException GetCommandLineA GetStartupInfoA HeapValidate IsBadReadPtr EnterCriticalSection LeaveCriticalSection GetModuleFileNameW TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId TlsFree GetModuleFileNameA WriteFile GetStdHandle GetOEMCP GetCPInfo IsValidCodePage GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate HeapFree VirtualFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc RtlUnwind OutputDebugStringA MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleMode FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP CloseHandle CreateFileA

user32

CharToOemBuffA

gdi32

GetCharWidth32A

Sharing