e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0.exe
Size 568KB
Sample260810-qvecqsak61
SHA256 e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0
MD5 c8592995d46b80edcb033b4bddea5054
SHA1 1e210b0873896adf29bd656ded7c6512b6287ac9
SHA512 eb6762249ce37e59e58c326d3e1ba0f6b749c6cbba5cc45d2da18d312d90d54c9e205471e1cf541b628ade56eed84f47d52d36147cff78ab17b56c741367aab3
SSDEEP 12288:yvhjnIxFQNJrZXTgekjyzfO1IdwXoRx4AP2x:yvJCQnZXFzfDwdx
TLSH
T16CC42266660116ECE4198B3711D24A31BC90AC0B5FAA14DF30E38534EDEDFDA4F369D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0.exe

File Explorer

e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0.exe

.exe 568KB

e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0.exe

IMPHASH 338bf1a4d5d7f38c551931d5564ac35b
SHA256 e66865e9f0c144108010fc769cecaa90c1c3a2bc7603896431695958816958e0
MD5 c8592995d46b80edcb033b4bddea5054
SHA1 1e210b0873896adf29bd656ded7c6512b6287ac9
SHA512 eb6762249ce37e59e58c326d3e1ba0f6b749c6cbba5cc45d2da18d312d90d54c9e205471e1cf541b628ade56eed84f47d52d36147cff78ab17b56c741367aab3
SSDEEP 12288:yvhjnIxFQNJrZXTgekjyzfO1IdwXoRx4AP2x:yvJCQnZXFzfDwdx
TLSH
T16CC42266660116ECE4198B3711D24A31BC90AC0B5FAA14DF30E38534EDEDFDA4F369D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler AssignProcessToJobObject CancelIo CancelThreadpoolIo CloseHandle ConnectNamedPipe CopyFileW CreateDirectoryExW CreateEventExW CreateMutexExW CreateRemoteThread CreateThreadpoolCleanupGroup DeleteTimerQueueTimer GetCurrentProcess GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetLongPathNameW GetModuleHandleA GetModuleHandleExA GetPrivateProfileSectionW GetPrivateProfileStringA GetProcAddress GetProcessHeap GetStringTypeExW GetTickCount GetVersionExW GlobalMemoryStatusEx GlobalReAlloc HeapAlloc HeapFree InitializeProcThreadAttributeList InterlockedPushEntrySList LoadLibraryA PeekNamedPipe PowerClearRequest Process32FirstW QueryActCtxW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException RaiseFailFastException RemoveVectoredExceptionHandler RtlPcToFileHeader ScrollConsoleScreenBufferA SetEvent SetFileTime SetThreadpoolThreadMaximum Sleep SwitchToThread VirtualAlloc VirtualFree VirtualProtect WaitForMultipleObjectsEx WakeConditionVariable WritePrivateProfileStringA

ntdll

EtwEventWrite NtAlpcAcceptConnectPort NtDeleteValueKey NtDisplayString NtQueryDirectoryFileEx NtQueryLicenseValue NtQueryPerformanceCounter NtQuerySystemTime NtQueryValueKey NtQueryWnfStateData NtSetEaFile NtSetSystemInformation NtSystemDebugControl NtWaitForSingleObject RtlAddAccessAllowedAceEx RtlAdjustPrivilege RtlCreateUnicodeString RtlFindMessage RtlInitializeGenericTable RtlIpv6StringToAddressW RtlLookupElementGenericTableAvl RtlMakeSelfRelativeSD RtlNumberOfSetBitsEx RtlReportException RtlStringFromGUID RtlSystemTimeToLocalTime TpAllocAlpcCompletion ZwQueryAttributesFile ZwQueryInformationProcess ZwQueryWnfStateData

user32

CharLowerW CheckDlgButton CheckMenuItem CreatePopupMenu DestroyAcceleratorTable DrawTextW EnableWindow EndDeferWindowPos EnumChildWindows FillRect GetClassLongPtrW GetDesktopWindow GetDlgCtrlID GetMonitorInfoW GetWindowInfo GetWindowLongW IsHungAppWindow NotifyWinEvent RegisterClassW RegisterClipboardFormatW RegisterHotKey ScrollWindowEx SetFocus SetProcessDefaultLayout TrackPopupMenu

shlwapi

PathIsNetworkPathW PathQuoteSpacesW PathRemoveBackslashW StrCmpNW

wintrust

CryptCATAdminEnumCatalogFromHash

bcrypt

BCryptDestroyHash

ole32

CoCreateGuid CoFreeUnusedLibraries CoGetInterfaceAndReleaseStream OleLockRunning ProgIDFromCLSID

dwmapi

DwmGetWindowAttribute

gdi32

BitBlt CreatePatternBrush GetCurrentObject GetLayout PatBlt SetAbortProc TranslateCharsetInfo

advapi32

CloseServiceHandle ConvertStringSidToSidW CryptGetKeyParam CryptImportKey EventRegister GetSecurityDescriptorDacl GetSidIdentifierAuthority GetSidSubAuthorityCount InitializeSecurityDescriptor OpenThreadToken QueryServiceStatus QueryServiceStatusEx RegCreateKeyExW RegUnLoadKeyW TraceEvent UnregisterTraceGuids

setupapi

SetupIterateCabinetW

rpcrt4

I_RpcExceptionFilter NdrServerCallAll RpcAsyncInitializeHandle RpcServerInqCallAttributesW RpcServerUnregisterIfEx

comdlg32

CommDlgExtendedError

gdiplus

GdipAlloc GdipCreateFromHDC GdipCreateSolidFill

iphlpapi

GetUnicastIpAddressEntry GetUnicastIpAddressTable

wtsapi32

WTSVirtualChannelClose

dnsapi

DnsNameCompare_W

crypt32

CertFreeCertificateContext CryptBinaryToStringW

imm32

ImmGetContext