6ddfc497d6820a9d69bbf6e4b63f2e1011da87479fa89392d983eef3437bb907[.]exe

General

Target
6ddfc497d6820a9d69bbf6e4b63f2e1011da87479fa89392d983eef3437bb907.exe
Size 741KB
Sample260809-tkm4ns1eqd
SHA256 6ddfc497d6820a9d69bbf6e4b63f2e1011da87479fa89392d983eef3437bb907
MD5 c8757716d8d48419fc0568a644f4e704
SHA1 49695c93ec920e6c51e7cf24d871e3447e75838c
SHA512 11e472be51f3bc4f854c97ec73853016cda552fa0f9794cdb0c650782bf943f50a3efb9051f525fc543c67cff558c2f85e75f72ba159b8d112d178d0bfee4e4d
SSDEEP 12288:vFUm/F4/PXPWUvPNEdzHyZ2O6picdBYNwMPuFhYaBpE+:vFpF4//OUnNEQZOp9uwMPuF+SpE
TLSH
T1C1F40113B2A6FCE5D915BA318D2AC9E4393EF951CE496AA737193F1F18700E2D663310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ddfc497d6820a9d69bbf6e4b63f2e1011da87479fa89392d983eef3437bb907.exe

File Explorer

6ddfc497d6820a9d69bbf6e4b63f2e1011da87479fa89392d983eef3437bb907.exe

.exe 741KB

6ddfc497d6820a9d69bbf6e4b63f2e1011da87479fa89392d983eef3437bb907.exe

IMPHASH a0f8b70c2bc21515b1abffdc2518b94f
SHA256 6ddfc497d6820a9d69bbf6e4b63f2e1011da87479fa89392d983eef3437bb907
MD5 c8757716d8d48419fc0568a644f4e704
SHA1 49695c93ec920e6c51e7cf24d871e3447e75838c
SHA512 11e472be51f3bc4f854c97ec73853016cda552fa0f9794cdb0c650782bf943f50a3efb9051f525fc543c67cff558c2f85e75f72ba159b8d112d178d0bfee4e4d
SSDEEP 12288:vFUm/F4/PXPWUvPNEdzHyZ2O6picdBYNwMPuFhYaBpE+:vFpF4//OUnNEQZOp9uwMPuF+SpE
TLSH
T1C1F40113B2A6FCE5D915BA318D2AC9E4393EF951CE496AA737193F1F18700E2D663310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

25198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\difidocegudebu\han niwihid\falame2.pdb

kernel32

GetConsoleAliasExesA UpdateResourceA DeleteVolumeMountPointA SetConsoleTextAttribute GetCommState GetConsoleAliasA WriteConsoleInputA FindCloseChangeNotification CreateHardLinkA GetTickCount GetWindowsDirectoryA GetDateFormatA GetPriorityClass WideCharToMultiByte LoadLibraryW FreeConsole GetSystemWindowsDirectoryA GetConsoleAliasExesLengthW EnumSystemCodePagesA GetNamedPipeInfo FileTimeToSystemTime SetComputerNameExW GetVolumePathNameA GetConsoleAliasesW InterlockedExchange GetModuleHandleExA GetLastError SetLastError BackupRead GetProcAddress VirtualAlloc PeekConsoleInputW RemoveDirectoryA LocalAlloc GetNumberFormatW FoldStringW GetOEMCP FreeEnvironmentStringsW VirtualProtect SetCalendarInfoA GlobalAddAtomW AddConsoleAliasA SetFileAttributesW CreateFileA WriteConsoleW GetConsoleOutputCP PeekNamedPipe FindFirstFileW FillConsoleOutputCharacterW FindResourceA WriteConsoleA CloseHandle FlushFileBuffers HeapFree GetModuleHandleW Sleep ExitProcess GetStartupInfoW GetCPInfo InterlockedIncrement InterlockedDecrement GetACP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapAlloc RaiseException HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc HeapSize MultiByteToWideChar ReadFile TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount GetStdHandle GetFileType GetStartupInfoA SetFilePointer WriteFile GetModuleFileNameA LoadLibraryA InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetModuleHandleA RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode

user32

CharToOemBuffW LoadMenuA GetWindowTextLengthW ChangeDisplaySettingsW

gdi32

GetCharWidthA GetCharABCWidthsFloatA GetBitmapDimensionEx

winhttp

WinHttpReadData WinHttpOpen

Sharing