2dcb65f18ee5ff985d4448c2bc01ecff8c1e379d969ef09591789dde8dd1d534[.]exe

General

Target
2dcb65f18ee5ff985d4448c2bc01ecff8c1e379d969ef09591789dde8dd1d534.exe
Size 841KB
Sample260809-sptatattdw
SHA256 2dcb65f18ee5ff985d4448c2bc01ecff8c1e379d969ef09591789dde8dd1d534
MD5 89f6a0761eb024c46520a74abb7868a9
SHA1 46f30dd561d328e61261ebe13f86340d0641de68
SHA512 61e5074a24deb928796edb7ccc2b57039aa6fbe6b9b8b216faa8e9e8dd549fbb84dae1e0ddbd2f142c92cb60dcb3075fbe05edf51255500647a59dea18a62316
SSDEEP 24576:5RvxJ2drWwS/kpBuOYNT0CpzbyfaQBQ246qgBvk:7vxJ2EwS/kpn6h246Vk
TLSH
T1BB05F11393D07C21E7278A72AE6E86F4661EB5604F5B7BEB635C9E2F05711E2C1B2301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dcb65f18ee5ff985d4448c2bc01ecff8c1e379d969ef09591789dde8dd1d534.exe

File Explorer

2dcb65f18ee5ff985d4448c2bc01ecff8c1e379d969ef09591789dde8dd1d534.exe

.exe 841KB

2dcb65f18ee5ff985d4448c2bc01ecff8c1e379d969ef09591789dde8dd1d534.exe

IMPHASH 150451e02d49e46634c10e914db67920
SHA256 2dcb65f18ee5ff985d4448c2bc01ecff8c1e379d969ef09591789dde8dd1d534
MD5 89f6a0761eb024c46520a74abb7868a9
SHA1 46f30dd561d328e61261ebe13f86340d0641de68
SHA512 61e5074a24deb928796edb7ccc2b57039aa6fbe6b9b8b216faa8e9e8dd549fbb84dae1e0ddbd2f142c92cb60dcb3075fbe05edf51255500647a59dea18a62316
SSDEEP 24576:5RvxJ2drWwS/kpBuOYNT0CpzbyfaQBQ246qgBvk:7vxJ2EwS/kpn6h246Vk
TLSH
T1BB05F11393D07C21E7278A72AE6E86F4661EB5604F5B7BEB635C9E2F05711E2C1B2301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

44140

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapReAlloc FindFirstFileW PeekNamedPipe BuildCommDCBAndTimeoutsA UpdateResourceA InterlockedIncrement SetDefaultCommConfigW CreateJobObjectW GetNamedPipeHandleStateA GetProfileSectionA GetModuleHandleW LocalFlags GetCommandLineA GlobalAlloc AddRefActCtx LoadLibraryW GetLocaleInfoW SetVolumeMountPointA ReadFile GetVolumePathNameA FindNextVolumeMountPointW InterlockedExchange DeleteFiber GetStartupInfoA FindFirstFileA GetCPInfoExW GetLastError GetCurrentDirectoryW SetLastError GetProcAddress HeapSize MoveFileW IsValidCodePage OpenWaitableTimerA WriteConsoleA GetNumberFormatW GetModuleHandleA FreeEnvironmentStringsW FindNextFileW GetConsoleCursorInfo ReadConsoleInputW LocalSize GetVolumeNameForVolumeMountPointW CreateFileW FlushFileBuffers WriteConsoleW WideCharToMultiByte InterlockedDecrement MultiByteToWideChar EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree DeleteFileA HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW IsProcessorFeaturePresent GetACP GetOEMCP TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle CloseHandle

user32

CharUpperA CharToOemBuffA

Sharing