4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2.exe
Size 3.1MB
Sample260810-rsbdqs1bkh
SHA256 4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2
MD5 266b6c12172e30c15ca9ce5461f4fb6a
SHA1 2da495c427eb233355b614d1a8e76252d7ccba5f
SHA512 7187bd71715e7023db9b58994edca054017a0fc9560c1c3da9d5ff1d565a5801f8df77d12363fc60f10ddbc0a488506cd4fe9b8806ed6bae2ce4e394efe6f161
SSDEEP 49152:Fv0LbCUjseTJDNvbfdf+s6gFJXyQMg3qzdXOEh:y64UQrqU
TLSH
T1DEE5AF46A3D40AE4D4E7DB30CA1A9733D2B1F86A0735974B0664C3462E77AA38F77325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2.exe

File Explorer

4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2.exe

.exe 3.1MB

4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2.exe

IMPHASH b0253ae8279600c3d8dc02919670baab
SHA256 4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2
MD5 266b6c12172e30c15ca9ce5461f4fb6a
SHA1 2da495c427eb233355b614d1a8e76252d7ccba5f
SHA512 7187bd71715e7023db9b58994edca054017a0fc9560c1c3da9d5ff1d565a5801f8df77d12363fc60f10ddbc0a488506cd4fe9b8806ed6bae2ce4e394efe6f161
SSDEEP 49152:Fv0LbCUjseTJDNvbfdf+s6gFJXyQMg3qzdXOEh:y64UQrqU
TLSH
T1DEE5AF46A3D40AE4D4E7DB30CA1A9733D2B1F86A0735974B0664C3462E77AA38F77325
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

388660

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW EventWrite EventRegister EventEnabled OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

TlsFree TlsSetValue MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetTickCount64 GetCurrentProcessorNumber GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetLastError GetCPInfo WideCharToMultiByte LocalAlloc GetConsoleOutputCP SetLastError GetProcAddress RaiseFailFastException ExpandEnvironmentStringsW FreeLibrary GetModuleFileNameW LoadLibraryExW CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile CloseHandle SetEvent CreateEventExW FormatMessageW FindClose GetEnvironmentVariableW CreateDirectoryW FindFirstFileW FindNextFileW CreateFileW GetFileSize ReadFile FreeConsole GetModuleHandleA LoadLibraryA FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

ole32

CoUninitialize CoCreateGuid CoGetApartmentType CoInitializeEx CoWaitForMultipleHandles

api-ms-win-crt-math-l1-1-0

modf pow ceil __setusermatherr

api-ms-win-crt-heap-l1-1-0

calloc _callnewh _set_new_mode free malloc

api-ms-win-crt-string-l1-1-0

strcmp wcsncmp _wcsicmp strcpy_s

vcruntime140

memcpy _purecall memmove memset

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _seh_filter_exe _set_app_type terminate __p___argc _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _register_onexit_function _initialize_onexit_table __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback abort

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

412KB

Virtual Size

411KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

974KB

Virtual Size

974KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

122KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

580B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic