02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4.exe
Size 2.0MB
Sample260810-sl7c9sha48
SHA256 02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4
MD5 a18c0d2d31da3b0d474fbde83cab5bb4
SHA1 6c854521579190958e7c90c3e72526268cd359f8
SHA512 ad442dafac4660fee2ff7c0671cdc328f297539e007bc09c59b7c92531a356cab7fe7aa335abd3193afdac53037350a27a939f0ccddaaf009161787abeeb4acf
SSDEEP 49152:VAIkXxxl0mFiaPgq0P1QBhQKLwyFrkuaUEXeo5I4Nbekxo41C2LJr/:iPATqPUuaUEXeo5I4Nbekxo41C2LJr/
TLSH
T18CA5BD15E3D821A8D427DA38CB54A333D2B1B9224B75E48F0A99C3061F77A919FBF711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4.exe

File Explorer

02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4.exe

.exe 2.0MB

02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4.exe

IMPHASH 65e41035c05e4ebec29685fad2d2799b
SHA256 02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4
MD5 a18c0d2d31da3b0d474fbde83cab5bb4
SHA1 6c854521579190958e7c90c3e72526268cd359f8
SHA512 ad442dafac4660fee2ff7c0671cdc328f297539e007bc09c59b7c92531a356cab7fe7aa335abd3193afdac53037350a27a939f0ccddaaf009161787abeeb4acf
SSDEEP 49152:VAIkXxxl0mFiaPgq0P1QBhQKLwyFrkuaUEXeo5I4Nbekxo41C2LJr/:iPATqPUuaUEXeo5I4Nbekxo41C2LJr/
TLSH
T18CA5BD15E3D821A8D427DA38CB54A333D2B1B9224B75E48F0A99C3061F77A919FBF711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

397048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

bcrypt

BCryptGenRandom

kernel32

EncodePointer FlsFree SetLastError FormatMessageW GetLastError LocalFree FindClose CloseHandle GetEnvironmentVariableW CreateDirectoryW FindFirstFileW FindNextFileW CreateFileW GetFileSize WriteFile ReadFile GetFileAttributesW CreateProcessW GetTickCount64 GetModuleHandleA LoadLibraryA GetProcAddress K32EnumProcessModulesEx IsWow64Process GetExitCodeProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId DuplicateHandle GetCurrentProcess GetCurrentProcessId GetStdHandle RaiseFailFastException GetCurrentThread Sleep DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx QueryPerformanceFrequency GetCPInfo WideCharToMultiByte LocalAlloc GetConsoleOutputCP ExpandEnvironmentStringsW FreeLibrary GetModuleFileNameW GetSystemDirectoryW LoadLibraryExW SetThreadErrorMode GetThreadPriority GetCurrentProcessorNumberEx SetEvent CreateEventExW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoUninitialize CoInitializeEx CoGetApartmentType CoTaskMemFree CoWaitForMultipleHandles

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh calloc

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-string-l1-1-0

_stricmp strcmp strcpy_s strlen

api-ms-win-crt-convert-l1-1-0

strtoull

vcruntime140

memcpy _purecall memmove memset

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _seh_filter_exe terminate abort _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _set_app_type __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit __p___argc

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

402KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

638KB

Virtual Size

638KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

596KB

Virtual Size

595KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

580B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

343KB

Virtual Size

342KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic