16426ff24dfb2d568d41366471199d62a8e98fb57c5a62e23efd612cd2adc018[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
16426ff24dfb2d568d41366471199d62a8e98fb57c5a62e23efd612cd2adc018.exe
Size 220KB
Sample260809-t48jqavvbv
SHA256 16426ff24dfb2d568d41366471199d62a8e98fb57c5a62e23efd612cd2adc018
MD5 a122d3856d069fcf34009dc5187a2425
SHA1 96394a0a2d12d52ccef98d6c568b735a1020d25b
SHA512 44553b1162958f5e78cc52e997ada3ff7150d1b0eb8de9bdf81193b91975ae04596bd296b6025e5ca8884f36e0c8eaae365fdf2b9cf3344c200993eeee2175ce
SSDEEP 3072:IkY8yckIfPJWifvyA3yP+ITv57bbOb6Wt1dNYVO9YHhi331erEMEs9Hb:6cVp/3yrTNbbObbfme31erNP
TLSH
T1D4247C16B76951FDD1A7C9B4C9434942EA32388A4B60BEDF07904BB77E226E49F3C701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16426ff24dfb2d568d41366471199d62a8e98fb57c5a62e23efd612cd2adc018.exe

File Explorer

16426ff24dfb2d568d41366471199d62a8e98fb57c5a62e23efd612cd2adc018.exe

.exe 220KB

16426ff24dfb2d568d41366471199d62a8e98fb57c5a62e23efd612cd2adc018.exe

IMPHASH 183388b096f04db8679b00d085f87f72
SHA256 16426ff24dfb2d568d41366471199d62a8e98fb57c5a62e23efd612cd2adc018
MD5 a122d3856d069fcf34009dc5187a2425
SHA1 96394a0a2d12d52ccef98d6c568b735a1020d25b
SHA512 44553b1162958f5e78cc52e997ada3ff7150d1b0eb8de9bdf81193b91975ae04596bd296b6025e5ca8884f36e0c8eaae365fdf2b9cf3344c200993eeee2175ce
SSDEEP 3072:IkY8yckIfPJWifvyA3yP+ITv57bbOb6Wt1dNYVO9YHhi331erEMEs9Hb:6cVp/3yrTNbbObbfme31erNP
TLSH
T1D4247C16B76951FDD1A7C9B4C9434942EA32388A4B60BEDF07904BB77E226E49F3C701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileW CreateDirectoryW CreateFileW CreateMutexW CreateProcessW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSize GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetWindowsDirectoryW HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadFile ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointer SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile

advapi32

GetTokenInformation OpenProcessToken

Name

.text

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

16426ff24dfb2d568d41366471199d62a8e98fb57c5a62e23efd612cd2adc018.exe

kernel32

advapi32

generic