f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb.exe
Size 3.8MB
Sample260810-rhryqszhlb
SHA256 f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb
MD5 a1b49589f198f600b99321173cd0ccb9
SHA1 eb202efa4444c09efb7b2aa251d2468bc532ccd5
SHA512 86dcd84a737b5597d7ba327d0ed76e77a3534fcef22ad5ad9d70b7c75f682d66805169d3c33875417253059fbccfb3ff0aaaa81ff0abaadce8ed332c3fd258b4
SSDEEP 49152:j3rhG6uM4q08ykizCL5+zEOOho992tB61HY8SB/Q8DbVCL30IjOqYzUGj4CUrfMy:MbagAD430Ijezzj4xTPnSob
TLSH
T195067D70D351B064D1A7C430CEDA4EF464A1703B52366D1F1BC5E81A25FBE61ABAE3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb.exe

File Explorer

f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb.exe

.exe 3.8MB

f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb.exe

IMPHASH e95f383854a3ed92d914fe20659df310
SHA256 f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb
MD5 a1b49589f198f600b99321173cd0ccb9
SHA1 eb202efa4444c09efb7b2aa251d2468bc532ccd5
SHA512 86dcd84a737b5597d7ba327d0ed76e77a3534fcef22ad5ad9d70b7c75f682d66805169d3c33875417253059fbccfb3ff0aaaa81ff0abaadce8ed332c3fd258b4
SSDEEP 49152:j3rhG6uM4q08ykizCL5+zEOOho992tB61HY8SB/Q8DbVCL30IjOqYzUGj4CUrfMy:MbagAD430Ijezzj4xTPnSob
TLSH
T195067D70D351B064D1A7C430CEDA4EF464A1703B52366D1F1BC5E81A25FBE61ABAE3A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

403548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

TlsFree TlsSetValue RaiseFailFastException GetTickCount64 GetProcAddress InitializeConditionVariable WakeConditionVariable CloseThreadpoolIo InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FileTimeToSystemTime GetLastError GetConsoleOutputCP GetCPInfo GetCurrentProcess GetStdHandle GetSystemTime LocalAlloc LocalFree QueryPerformanceCounter QueryPerformanceFrequency SetLastError SystemTimeToFileTime WaitForMultipleObjectsEx WaitForSingleObject GetCurrentThread TzSpecificLocalTimeToSystemTime WideCharToMultiByte Sleep SleepConditionVariableCS CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FreeLibrary GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLongPathNameW GetModuleFileNameW GetOverlappedResult LoadLibraryExW SetFileInformationByHandle SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW FreeConsole GetModuleHandleA LoadLibraryA FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId

ole32

CoWaitForMultipleHandles CoUninitialize CoGetApartmentType CoInitializeEx

api-ms-win-crt-math-l1-1-0

modf sqrt pow ceil __setusermatherr

api-ms-win-crt-heap-l1-1-0

_callnewh malloc calloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

strlen _stricmp wcsncmp strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

vcruntime140

_purecall memmove memset memcpy

api-ms-win-crt-runtime-l1-1-0

abort terminate _crt_atexit _seh_filter_exe _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _initialize_onexit_table __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

410KB

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

342KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f66bd3ba1b2b9190f924031ebb2346338df2e26c189850ee3237ea80adc898eb.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic