d237b0afaa41b0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
d237b0afaa41b0.exe
Size 442KB
Sample260810-pmx97stwct
SHA256 c157303075f3bfe9e3659d863ba4463aed8c9116dda017aec9668b18ebda636b
MD5 89ebc7a0b67d4c738873df373ce01ea3
SHA1 bcb97898bff9132f7b495acddabc4f2cef970c7b
SHA512 dfb65b0457e617bc6950f991e9905e8f0e25d34ba66117965a199468c0d7fe6c59cb987c52c019689f1e30e02663314a994950509dacd6cb414a9719432719b8
SSDEEP 12288:S7OD0LMFAwIPXzdrNEYmd5vMuwUaHTNE+IjqudUKHB:SSDcMawIPMY
TLSH
T1CEA46C16B65660FDC15BC1B8C6434926EA75788A0B70EADF43E8C6352F63AE05F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d237b0afaa41b0.exe

File Explorer

d237b0afaa41b0.exe

.exe 442KB

d237b0afaa41b0.exe

IMPHASH 2a7d45962185be165d7dba8779421173
SHA256 c157303075f3bfe9e3659d863ba4463aed8c9116dda017aec9668b18ebda636b
MD5 89ebc7a0b67d4c738873df373ce01ea3
SHA1 bcb97898bff9132f7b495acddabc4f2cef970c7b
SHA512 dfb65b0457e617bc6950f991e9905e8f0e25d34ba66117965a199468c0d7fe6c59cb987c52c019689f1e30e02663314a994950509dacd6cb414a9719432719b8
SSDEEP 12288:S7OD0LMFAwIPXzdrNEYmd5vMuwUaHTNE+IjqudUKHB:SSDcMawIPMY
TLSH
T1CEA46C16B65660FDC15BC1B8C6434926EA75788A0B70EADF43E8C6352F63AE05F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

168616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpWebSocketClose WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

ntdll

NtLoadDriver NtQuerySystemInformation NtUnloadDriver RtlAdjustPrivilege RtlCaptureContext RtlInitUnicodeString RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

advapi32

RegCloseKey RegCreateKeyW RegDeleteTreeW RegEnumKeyExW RegGetValueW RegOpenKeyExW RegOpenKeyW RegSetKeyValueW

user32

MessageBoxA

kernel32

AcquireSRWLockExclusive CheckRemoteDebuggerPresent CloseHandle CreateFileW CreateProcessW CreateRemoteThread DecodePointer DefineDosDeviceW DeleteCriticalSection DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetTickCount64 GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

Name

.text

Size

283KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.junk

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.stellaa

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

37B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d237b0afaa41b0.exe

winhttp

bcrypt

ntdll

advapi32

user32

kernel32

generic