cfb961347c192bd6dfa4e8b86b9a6eb04fca7f29b51b577ffa1465e7a75c733d[.]exe

General

Target
cfb961347c192bd6dfa4e8b86b9a6eb04fca7f29b51b577ffa1465e7a75c733d.exe
Size 809KB
Sample260809-slbatsttbz
SHA256 cfb961347c192bd6dfa4e8b86b9a6eb04fca7f29b51b577ffa1465e7a75c733d
MD5 bd7beb7562fbbb5d6a7773f879389d32
SHA1 993ad0a915e475bafb3833b61a36818481dd55aa
SHA512 d762255b0cb9095b72f8b4d5821559f2134c6de28e4e7072e78a42870647d9ff1375afc33d7c6b46ba7fff509ab6f4724e4842abf47eb1c1a41e72783dbf38ba
SSDEEP 12288:x1lw2NU9n4c7lB5P5ZQwshmMs5OR2aX+975V3BOh6Z5EGyjShHT0q78nDHrJ:x1lwxD7TzZQHmR5OR2aXgrRqj6HTh2
TLSH
T10105022152E0F470D1278A329E2AC7EC6A3DF8E09F557A9F27981A3F1E761E1C171319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfb961347c192bd6dfa4e8b86b9a6eb04fca7f29b51b577ffa1465e7a75c733d.exe

File Explorer

cfb961347c192bd6dfa4e8b86b9a6eb04fca7f29b51b577ffa1465e7a75c733d.exe

.exe 809KB

cfb961347c192bd6dfa4e8b86b9a6eb04fca7f29b51b577ffa1465e7a75c733d.exe

IMPHASH 2f42c7240ce091676db27467fe8eb2d6
SHA256 cfb961347c192bd6dfa4e8b86b9a6eb04fca7f29b51b577ffa1465e7a75c733d
MD5 bd7beb7562fbbb5d6a7773f879389d32
SHA1 993ad0a915e475bafb3833b61a36818481dd55aa
SHA512 d762255b0cb9095b72f8b4d5821559f2134c6de28e4e7072e78a42870647d9ff1375afc33d7c6b46ba7fff509ab6f4724e4842abf47eb1c1a41e72783dbf38ba
SSDEEP 12288:x1lw2NU9n4c7lB5P5ZQwshmMs5OR2aX+975V3BOh6Z5EGyjShHT0q78nDHrJ:x1lwxD7TzZQHmR5OR2aXgrRqj6HTh2
TLSH
T10105022152E0F470D1278A329E2AC7EC6A3DF8E09F557A9F27981A3F1E761E1C171319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

27997

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalUnlock FindFirstFileW SetThreadContext WriteConsoleInputW CommConfigDialogA DebugActiveProcessStop ConvertThreadToFiber GlobalAddAtomA InterlockedIncrement HeapFree GetEnvironmentStringsW GetFileAttributesExA GetModuleHandleW ReadConsoleW GetCompressedFileSizeW GetCommandLineA GetConsoleCP GlobalAlloc SetFileShortNameW LoadLibraryW GetLocaleInfoW ReadFileScatter SetVolumeMountPointA DeleteVolumeMountPointW GlobalFlags GetConsoleAliasW GetModuleFileNameW FlushFileBuffers GetShortPathNameA GetNamedPipeHandleStateW GetCPInfoExW GetLastError GetCurrentDirectoryW SetLastError SetComputerNameA LoadLibraryA WriteConsoleA OpenWaitableTimerW FoldStringA FindNextFileA FindFirstVolumeMountPointA GetModuleHandleA UpdateResourceW VirtualProtect GetCPInfoExA GetWindowsDirectoryW GetProfileSectionW CreateFileW SetStdHandle SetFilePointer WriteConsoleW InterlockedDecrement Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer MoveFileA HeapReAlloc HeapSetInformation GetStartupInfoW RtlUnwind HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapSize GetProcAddress ExitProcess HeapCreate HeapDestroy RaiseException WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetCurrentThread QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo FatalAppExitA GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW MultiByteToWideChar SetConsoleCtrlHandler FreeLibrary LCMapStringW GetConsoleMode ReadFile CloseHandle DeleteFileA

user32

CharUpperBuffW CharToOemBuffW GetNextDlgTabItem

Sharing