g48hfg234h8902f10hj[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
g48hfg234h8902f10hj.exe
Size 63.7MB
Sample260820-tg4bgstyev
SHA256 ebd2599acc81b10221cec554c5da809b6b04e99a1bb1d44e5ba63633519cd7e7
MD5 dc686fa5584c6527f061faef9e6ff029
SHA1 3a2dc5b8175efa1b666ed4f4346106343bb26d9c
SHA512 b8328157a570647c2e487f11a3f1b713ec9303805e71d30070d9e748801a8987d56dc843142af92b18f73e42b6144c2ca84b2a85a4fb0a3a650cb49d1dcdb6da
SSDEEP 786432:FQsCU8v3GGYDYjOhfzhTMPpHqvWFZDUV0Hd6:FQsCVv3GGYDYj2fzhTMBHq
TLSH
T130E7414C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
g48hfg234h8902f10hj.exe

File Explorer

g48hfg234h8902f10hj.exe

.exe 63.7MB

g48hfg234h8902f10hj.exe

IMPHASH 75aa9d3438121bbe8671d90d5ac9d71b
SHA256 ebd2599acc81b10221cec554c5da809b6b04e99a1bb1d44e5ba63633519cd7e7
MD5 dc686fa5584c6527f061faef9e6ff029
SHA1 3a2dc5b8175efa1b666ed4f4346106343bb26d9c
SHA512 b8328157a570647c2e487f11a3f1b713ec9303805e71d30070d9e748801a8987d56dc843142af92b18f73e42b6144c2ca84b2a85a4fb0a3a650cb49d1dcdb6da
SSDEEP 786432:FQsCU8v3GGYDYjOhfzhTMPpHqvWFZDUV0Hd6:FQsCVv3GGYDYj2fzhTMBHq
TLSH
T130E7414C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55720912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WideCharToMultiByte GetModuleHandleA LoadLibraryA QueryPerformanceCounter ReadFile VirtualProtect SetLastError GetCurrentProcess TerminateProcess GetLastError CreateFileA CloseHandle GetThreadContext GetFileSize ExitProcess GetCurrentProcessId IsDebuggerPresent CheckRemoteDebuggerPresent LoadLibraryExW SetConsoleTitleW GetTempFileNameW GetConsoleWindow FreeLibrary GetProcAddress LoadLibraryW WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindClose GetOEMCP GetACP IsValidCodePage GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW MultiByteToWideChar GetModuleHandleW Sleep GetTempPathW SetConsoleWindowInfo GetStdHandle GetModuleHandleExW UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry OutputDebugStringW RtlUnwind InitializeSListHead GetSystemTimeAsFileTime FindFirstFileExW CreateFileW SetConsoleScreenBufferSize GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile MapViewOfFile CreateFileMappingA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree LCMapStringEx GetStringTypeW GetCPInfo K32GetModuleInformation AddVectoredExceptionHandler RaiseException GetProcessHeap HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize DuplicateHandle GetSystemInfo IsWow64Process VirtualFreeEx GetSystemDirectoryA SetFilePointer VirtualAllocEx GetTickCount RemoveVectoredExceptionHandler VirtualAlloc VirtualFree VirtualQuery

user32

FindWindowW GetWindowLongPtrW PostThreadMessageW SetWindowLongPtrW UnregisterClassA SetWindowsHookExW GetWindowThreadProcessId

advapi32

ConvertSidToStringSidA CopySid OpenProcessToken GetLengthSid LookupAccountSidA OpenThreadToken GetTokenInformation IsValidSid

vmprotectsdk64

VMProtectBeginUltra VMProtectBeginMutation VMProtectEnd

urlmon

URLDownloadToFileW

dbghelp

ImageDirectoryEntryToData

shlwapi

ord215

userenv

UnloadUserProfile

ntdll

NtClose RtlImageNtHeader NtUnmapViewOfSection NtCreateSection NtMapViewOfSection

Name

.text

Size

53.2MB

Virtual Size

53.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

165KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

g48hfg234h8902f10hj.exe

kernel32

user32

advapi32

vmprotectsdk64

urlmon

dbghelp

shlwapi

userenv

ntdll

generic