c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe
Size 2.2MB
Sample260809-wl2dsswtfv
SHA256 c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc
MD5 24716e14e19d191b25146524d92544af
SHA1 069dcc1f535c674c90a389aaa07ede3e734281e9
SHA512 4178a40db0534e50756b2e31b170f240bd7954243e4eef0114684b0d0e7f16293be04bd1f0a622ab9bf5790b12f5c74d969d29983e4bad09cfb975ab45209700
SSDEEP 24576:Bgp5BNnvoCzuSiwznsebo1UsFonsbbHf1H2uAzlMfBNN0OzV6DNUOPXX3n5DpnFz:BgpNQCzziwuTAzlM2N+1ycnZlnm5uo
TLSH
T1DCA5BE14E3E811A9E463DA34CB51A333D6B178624775E49F0A99C30A1F77E928F7B702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe

File Explorer

c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe

.exe 2.2MB

c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe

IMPHASH 307f7e81c25ffd921ae92e385bccaf0d
SHA256 c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc
MD5 24716e14e19d191b25146524d92544af
SHA1 069dcc1f535c674c90a389aaa07ede3e734281e9
SHA512 4178a40db0534e50756b2e31b170f240bd7954243e4eef0114684b0d0e7f16293be04bd1f0a622ab9bf5790b12f5c74d969d29983e4bad09cfb975ab45209700
SSDEEP 24576:Bgp5BNnvoCzuSiwznsebo1UsFonsbbHf1H2uAzlMfBNN0OzV6DNUOPXX3n5DpnFz:BgpNQCzziwuTAzlM2N+1ycnZlnm5uo
TLSH
T1DCA5BE14E3E811A9E463DA34CB51A333D6B178624775E49F0A99C30A1F77E928F7B702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

398244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegQueryValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegCreateKeyExW RegSetValueExW

bcrypt

BCryptGenRandom

kernel32

EncodePointer FlsFree SetLastError FormatMessageW GetLastError K32EnumProcessModulesEx CloseHandle IsWow64Process GetExitCodeProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId DuplicateHandle GetCurrentProcess GetCurrentProcessId GetStdHandle RaiseFailFastException GetTickCount64 GetCurrentThread WaitForSingleObject Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork QueryPerformanceFrequency GetCPInfo WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress CreateIoCompletionPort ExpandEnvironmentStringsW FreeLibrary GetModuleFileNameW GetSystemDirectoryW LoadLibraryExW SetThreadErrorMode CreateThread ResumeThread GetThreadPriority SetThreadPriority WriteFile GetCurrentProcessorNumberEx SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW FindClose CreateDirectoryW FindFirstFileW FindNextFileW CreateFileW GetFileSize ReadFile GetFileAttributesW CreateProcessW GetModuleHandleA LoadLibraryA FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoWaitForMultipleHandles CoTaskMemFree CoCreateGuid CoInitializeEx CoUninitialize CoGetApartmentType

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode calloc

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-string-l1-1-0

strcpy_s strlen _stricmp strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

vcruntime140

memset memmove memcpy _purecall

api-ms-win-crt-runtime-l1-1-0

terminate _crt_atexit _register_onexit_function _initialize_onexit_table _seh_filter_exe _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type abort

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

403KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

726KB

Virtual Size

726KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

367KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

660KB

Virtual Size

660KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

580B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

343KB

Virtual Size

342KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c394b09989c31d4f1c9f73a806458159c1df03132ae97f578abe43b56fa832fc.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic