file_851477f5539ff9f4[.]exe

General

Target
file_851477f5539ff9f4.exe
Size 294KB
Sample260818-plmgbascle
SHA256 8d3ec44d1d9e8b5e0ce534c639d071b41356d0b153dcc399d03d34284fd4e555
MD5 a2ff850f483897e1542a665c2fc39c98
SHA1 c53765cedf4b59644d18133741ccc75b61e5afe5
SHA512 a42fb262cb291dfd0887412b6dc8170c1a78f8b60cd2c395c0cbb302fc04669a6c22146615904c6a93e188cb53d41a3fc024e83eea108be7709582022ca2e46b
SSDEEP 6144:/pQS+/iWYcVw1pdAYhde23HCp5aBzg6Dn:hS/iWJUAYhv3HlBg6
TLSH
T125547C6AB3A918F5D9E7C17D86920A06E77138458770D7CF03E402663F1B6E19D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file_851477f5539ff9f4.exe

File Explorer

file_851477f5539ff9f4.exe

.exe 294KB

file_851477f5539ff9f4.exe

IMPHASH 72a84177c93f526001a9c9cbf59f53e7
SHA256 8d3ec44d1d9e8b5e0ce534c639d071b41356d0b153dcc399d03d34284fd4e555
MD5 a2ff850f483897e1542a665c2fc39c98
SHA1 c53765cedf4b59644d18133741ccc75b61e5afe5
SHA512 a42fb262cb291dfd0887412b6dc8170c1a78f8b60cd2c395c0cbb302fc04669a6c22146615904c6a93e188cb53d41a3fc024e83eea108be7709582022ca2e46b
SSDEEP 6144:/pQS+/iWYcVw1pdAYhde23HCp5aBzg6Dn:hS/iWJUAYhv3HlBg6
TLSH
T125547C6AB3A918F5D9E7C17D86920A06E77138458770D7CF03E402663F1B6E19D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

93696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA

kernel32

SetStdHandle WriteConsoleW GetLastError InitializeCriticalSection DeleteCriticalSection VirtualAlloc VirtualFree GetProcAddress LoadLibraryA SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException CreateFileW RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW SetConsoleCtrlHandler GetModuleFileNameW GetStdHandle WriteFile IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileType HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStringTypeW HeapSize HeapReAlloc CloseHandle

Name

.text

Size

189KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file_851477f5539ff9f4.exe

user32

kernel32

generic