c1d38432a5040db8be37ca31b025d1edd42be37799bfd254b3c6e7c4e37937b8[.]exe

General

Target
c1d38432a5040db8be37ca31b025d1edd42be37799bfd254b3c6e7c4e37937b8.exe
Size 791KB
Sample260824-eqrayscn7t
SHA256 c1d38432a5040db8be37ca31b025d1edd42be37799bfd254b3c6e7c4e37937b8
MD5 faa9d40c1e4e3fd2dcc3f3da18bc7b27
SHA1 86796facbad7e1d2eb6f9b12fd47bd6f472d0c4d
SHA512 4d468092af2b5031fa513d61315d1da653ce689c0a63c35065630daeca0a9d93958310c7e792826965f46336be7bb6e4c090b320e6193d7be8809a7cc936a675
SSDEEP 12288:GDijA9yzMOzv/27zaCCOQLdtDUZxiGMEkRPnu3KGaSDtCCPpn:GW09yRzv+7mCsdtQ/VYuRZCChn
TLSH
T13B0523613B11F032D466043379A6C3E92E2F1D33452A89C77B527BEE8FA17919B617C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1d38432a5040db8be37ca31b025d1edd42be37799bfd254b3c6e7c4e37937b8.exe

File Explorer

c1d38432a5040db8be37ca31b025d1edd42be37799bfd254b3c6e7c4e37937b8.exe

.exe 791KB

c1d38432a5040db8be37ca31b025d1edd42be37799bfd254b3c6e7c4e37937b8.exe

IMPHASH 95ad07e52855bf052511ff6b3b1e2bcf
SHA256 c1d38432a5040db8be37ca31b025d1edd42be37799bfd254b3c6e7c4e37937b8
MD5 faa9d40c1e4e3fd2dcc3f3da18bc7b27
SHA1 86796facbad7e1d2eb6f9b12fd47bd6f472d0c4d
SHA512 4d468092af2b5031fa513d61315d1da653ce689c0a63c35065630daeca0a9d93958310c7e792826965f46336be7bb6e4c090b320e6193d7be8809a7cc936a675
SSDEEP 12288:GDijA9yzMOzv/27zaCCOQLdtDUZxiGMEkRPnu3KGaSDtCCPpn:GW09yRzv+7mCsdtQ/VYuRZCChn
TLSH
T13B0523613B11F032D466043379A6C3E92E2F1D33452A89C77B527BEE8FA17919B617C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

1069056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tayawabo\zitopa\lus_rodaner.pdb

kernel32

MoveFileExW CreateDirectoryExA FreeEnvironmentStringsA GetConsoleAliasesLengthA GetConsoleTitleA ReadConsoleW CreateDirectoryExW LoadLibraryW LeaveCriticalSection WriteConsoleW GetBinaryTypeA GetMailslotInfo lstrlenW ReplaceFileA GetConsoleAliasesW GetStdHandle GetLastError SetConsoleTextAttribute VirtualAlloc MoveFileW WriteProfileSectionA LoadLibraryA WriteConsoleA GetProcessWorkingSetSize SetCalendarInfoW FindFirstChangeNotificationA QueueUserWorkItem VirtualProtect GetCPInfoExA InterlockedPushEntrySList AllocConsole GetProcAddress SetFilePointer HeapReAlloc HeapAlloc GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount GetFileType DeleteCriticalSection EnterCriticalSection HeapCreate VirtualFree HeapFree GetModuleHandleW Sleep ExitProcess WriteFile GetModuleFileNameA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar ReadFile InitializeCriticalSectionAndSpinCount SetStdHandle RtlUnwind GetConsoleOutputCP LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers HeapSize CreateFileA CloseHandle

user32

ClientToScreen

advapi32

ClearEventLogW

Sharing