c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c[.]exe

General

Target
c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe
Size 802KB
Sample260809-rz18qszdmd
SHA256 c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c
MD5 afdd799a769a2fd3f66c2fad9f1d1026
SHA1 b08ec120f594b4b3c972a52bb4e7be343a62ef25
SHA512 98d4e6710c714aceb87fa2f941d549344e48fca42ca690b3e5e26f122aee29682845ce65d82980722edf25e463bf9b96fa8a822e9248872027fbee7818180cb7
SSDEEP 12288:L6mUIxb/0PkTi7YKuJJ2o48w/ukC+v8JJ1IyPEg:cIh3i7YJ2D8iDELIyPEg
TLSH
T1DA058C5382E13E49F9658B729F1FE6EC7B0DB6608F6D376612199E1F00B20B2D163721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe

File Explorer

c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe

.exe 802KB

c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c.exe

IMPHASH cec96b74373fe00d227864e9b27d8ac1
SHA256 c96ebdb12684d0b47ebd0fa81aee556c8c981b942262d2169d9f63dc3b7e5a7c
MD5 afdd799a769a2fd3f66c2fad9f1d1026
SHA1 b08ec120f594b4b3c972a52bb4e7be343a62ef25
SHA512 98d4e6710c714aceb87fa2f941d549344e48fca42ca690b3e5e26f122aee29682845ce65d82980722edf25e463bf9b96fa8a822e9248872027fbee7818180cb7
SSDEEP 12288:L6mUIxb/0PkTi7YKuJJ2o48w/ukC+v8JJ1IyPEg:cIh3i7YJ2D8iDELIyPEg
TLSH
T1DA058C5382E13E49F9658B729F1FE6EC7B0DB6608F6D376612199E1F00B20B2D163721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8204

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\pebecejikov\59\hececeboveyit kegid_xifufe\xikiricow.pdb

kernel32

WriteConsoleOutputCharacterW GetConsoleAliasesLengthW GetLocaleInfoA SetComputerNameExA InterlockedIncrement InterlockedDecrement InterlockedCompareExchange SetCommBreak CreateHardLinkA GetModuleHandleW GetTickCount GlobalFindAtomA WriteConsoleW GetConsoleFontSize GetStartupInfoW SetThreadContext SetLastError GetProcAddress VirtualAlloc SetComputerNameA LoadLibraryA LocalAlloc DeleteTimerQueue AddAtomW QueryDosDeviceW lstrcmpiW FindFirstChangeNotificationA DeleteFileW GetCurrentProcessId ResetWriteWatch SuspendThread FindResourceA GetLastError GetComputerNameA Sleep ExitProcess HeapAlloc HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind HeapSize WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW RaiseException

gdi32

GetCharABCWidthsFloatA DeleteDC

shell32

FindExecutableA

Sharing