565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe
Size 1.4MB
Sample260819-rb89fack6x
SHA256 565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56
MD5 38981196a3a04fa8f5142ce4459c47c8
SHA1 3db51f218b9a3c6dd68f282407a8dc3e62ca2ab4
SHA512 7c6de6d35ddf51135e1ef93397ebd2dbcf4ecbe509b08120014bfe99a82a99a9fb98c41fe85b7c12f611717c7468a370fcbe7c6a3b401ae982ba62bf4b044dac
SSDEEP 24576:OXWftVq6ZP732cZxAhw/68mK8ywVDY92DLR/P/r1fFMGMbl998MicJ:OXWFsUWhw/68mK8lMUCR
TLSH
T13465CF1DE38C12E9D627C534CBA29632E775B8460B61BADB079DC2152F739D02F3A315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe

File Explorer

565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe

.exe 1.4MB

565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe

IMPHASH b10fe6479fabfb193ccc36fc8bef56cd
SHA256 565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56
MD5 38981196a3a04fa8f5142ce4459c47c8
SHA1 3db51f218b9a3c6dd68f282407a8dc3e62ca2ab4
SHA512 7c6de6d35ddf51135e1ef93397ebd2dbcf4ecbe509b08120014bfe99a82a99a9fb98c41fe85b7c12f611717c7468a370fcbe7c6a3b401ae982ba62bf4b044dac
SSDEEP 24576:OXWftVq6ZP732cZxAhw/68mK8ywVDY92DLR/P/r1fFMGMbl998MicJ:OXWFsUWhw/68mK8lMUCR
TLSH
T13465CF1DE38C12E9D627C534CBA29632E775B8460B61BADB079DC2152F739D02F3A315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

690372

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DeregisterEventSource

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CreateEventExW CreateFileW DuplicateHandle FormatMessageW FreeLibrary GetCPInfo GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetModuleFileNameW GetProcAddress GetStdHandle GetThreadPriority GetTickCount64 LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException SetEvent SetLastError SetThreadErrorMode Sleep VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread FlushProcessWriteBuffers GetThreadContext SetThreadContext GetSystemTimeAsFileTime CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoUninitialize CoWaitForMultipleHandles CoGetApartmentType CoInitializeEx

api-ms-win-crt-heap-l1-1-0

malloc calloc _set_new_mode _callnewh free

api-ms-win-crt-math-l1-1-0

log __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s _stricmp strlen strcpy strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _crt_atexit terminate abort _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _register_onexit_function __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

690KB

Virtual Size

689KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

187KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.gfx

Size

419KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic