1b7f7b031d5c653dbedd8e6b6d42ffa38b578487e5665825372ae817ef912089[.]exe

General

Target
1b7f7b031d5c653dbedd8e6b6d42ffa38b578487e5665825372ae817ef912089.exe
Size 739KB
Sample260809-nt39csek6s
SHA256 1b7f7b031d5c653dbedd8e6b6d42ffa38b578487e5665825372ae817ef912089
MD5 9c386f0553f080254ae892482aaa46f6
SHA1 670c07b629d4c4b4afaa0e45a3d5676c3f68aaff
SHA512 e6ff14a3c37093c4fdd8db5af88481caba338372f0ba7ba641777cc75c5203f11c5093a9e11b405a1d3705acaeededdcb8b17e79972facea0beca9d6a091742c
SSDEEP 12288:NGGrgI+Ss+6DeBTd4NT5/6MesF786s9O/BWfCnBngASkQh7srb3gVyJ3:NGD5KTcT5/SsFLeyFHLkQrb3gVyJ3
TLSH
T1E6F4121273D8803AF36752744A61DA6089777C668F3359CFABD6536F1E632E2CE88305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b7f7b031d5c653dbedd8e6b6d42ffa38b578487e5665825372ae817ef912089.exe

File Explorer

1b7f7b031d5c653dbedd8e6b6d42ffa38b578487e5665825372ae817ef912089.exe

.exe 739KB

1b7f7b031d5c653dbedd8e6b6d42ffa38b578487e5665825372ae817ef912089.exe

IMPHASH 9939b7637333f09fd7c0070786cd743f
SHA256 1b7f7b031d5c653dbedd8e6b6d42ffa38b578487e5665825372ae817ef912089
MD5 9c386f0553f080254ae892482aaa46f6
SHA1 670c07b629d4c4b4afaa0e45a3d5676c3f68aaff
SHA512 e6ff14a3c37093c4fdd8db5af88481caba338372f0ba7ba641777cc75c5203f11c5093a9e11b405a1d3705acaeededdcb8b17e79972facea0beca9d6a091742c
SSDEEP 12288:NGGrgI+Ss+6DeBTd4NT5/6MesF786s9O/BWfCnBngASkQh7srb3gVyJ3:NGD5KTcT5/SsFLeyFHLkQrb3gVyJ3
TLSH
T1E6F4121273D8803AF36752744A61DA6089777C668F3359CFABD6536F1E632E2CE88305
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19909

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadHugeReadPtr SetEndOfFile LocalCompact CreateHardLinkA GetModuleHandleW GetCurrentThread GetProcessHeap EnumResourceTypesA GlobalAlloc GetSystemDirectoryW LoadLibraryW IsProcessInJob AssignProcessToJobObject IsBadWritePtr GetLastError SetLastError GetProcAddress VerLanguageNameA FindClose LoadLibraryA SetConsoleCtrlHandler AddAtomW CreateEventW HeapWalk GlobalHandle GetModuleFileNameA GetOEMCP GlobalUnWire EnumResourceNamesA PeekConsoleInputA Module32NextW GetDiskFreeSpaceExW CreateFileW SetStdHandle WriteConsoleW SetFilePointer HeapReAlloc IsValidLocale EnumSystemLocalesA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW IsProcessorFeaturePresent HeapCreate ReadFile UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers InitializeCriticalSectionAndSpinCount ExitProcess GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA CloseHandle

user32

GetMessageExtraInfo CharUpperBuffA GetCursorPos SetMenu SetCaretPos GetCaretBlinkTime SetClipboardViewer

Name

.text

Size

644KB

Virtual Size

643KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

28.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bobibu

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tagox

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buxecu

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1b7f7b031d5c653dbedd8e6b6d42ffa38b578487e5665825372ae817ef912089.exe

kernel32

user32

generic