MrAhmedSamir[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MrAhmedSamir.exe
Size 1.1MB
Sample260828-1cln7stdmc
SHA256 c0fdba1d1a5ad092df8e04b24dfcbae68015d992f047a68955b4f927c7dc5ddc
MD5 2acff37d94c2ad6c7a6c4e18e25cdb10
SHA1 03aa71538b403a2d9c46ac23743c0c1dbf941787
SHA512 66d2f596639f9bdaee2b5d5fe81f4cdfeb5a3d093250a42951f67aef568f094ed28828417268e4a16791853289a1ae7c6b4a0921e23e5f41b490bdad0b85d391
SSDEEP 12288:MYXjNdssYAZzx8VURmaXZycrpZRakBq+NC9uDAZJKJ9XXp7uTYv+3bcxbZr/kBC9:MmNdsPRazCiqGC9hUvwg
TLSH
T197356D5D6A0241B2E1BD35B041A66B7505FE5D396B20B9C3AACF3E2B473F1E02D3522D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MrAhmedSamir.exe

File Explorer

MrAhmedSamir.exe

.exe 1.1MB

MrAhmedSamir.exe

IMPHASH 2bdea8a5cc26ee438dd7ac9434d1ea33
SHA256 c0fdba1d1a5ad092df8e04b24dfcbae68015d992f047a68955b4f927c7dc5ddc
MD5 2acff37d94c2ad6c7a6c4e18e25cdb10
SHA1 03aa71538b403a2d9c46ac23743c0c1dbf941787
SHA512 66d2f596639f9bdaee2b5d5fe81f4cdfeb5a3d093250a42951f67aef568f094ed28828417268e4a16791853289a1ae7c6b4a0921e23e5f41b490bdad0b85d391
SSDEEP 12288:MYXjNdssYAZzx8VURmaXZycrpZRakBq+NC9uDAZJKJ9XXp7uTYv+3bcxbZr/kBC9:MmNdsPRazCiqGC9hUvwg
TLSH
T197356D5D6A0241B2E1BD35B041A66B7505FE5D396B20B9C3AACF3E2B473F1E02D3522D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

459046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Codes_ALL\E-Learning\Ahmed-Samir\WebView2Browser-main\Release_x86\WebView2Browser.pdb

webview2loader

CreateCoreWebView2EnvironmentWithOptions GetAvailableCoreWebView2BrowserVersionString

normaliz

IdnToAscii

ws2_32

WSACloseEvent freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket WSACreateEvent htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSAGetLastError send recv WSAEnumNetworkEvents WSAEventSelect closesocket recvfrom sendto ntohl listen gethostname

wldap32

ord27 ord26 ord22 ord41 ord50 ord45 ord60 ord211 ord46 ord217 ord143 ord33 ord301 ord35 ord200 ord32 ord30 ord79

advapi32

CryptEncrypt CryptGetHashParam RegOpenKeyExA CryptDestroyHash CryptHashData CryptCreateHash GetUserNameA RegQueryValueExA GetCurrentHwProfileA RegGetValueA RegCloseKey CryptAcquireContextA RegSetValueExA CryptGenRandom CryptDestroyKey CryptImportKey CryptReleaseContext

libcrypto-1_1

EVP_CIPHER_CTX_free EVP_EncryptUpdate EVP_EncryptFinal_ex EVP_CIPHER_CTX_new EVP_aes_256_cbc EVP_DecryptUpdate EVP_CIPHER_block_size EVP_DecryptFinal_ex OPENSSL_init_crypto EVP_EncryptInit_ex EVP_DecryptInit_ex

kernel32

IsDebuggerPresent DebugBreak GetModuleHandleW GetProcessHeap GetCurrentProcessId LocalFree CreateMutexExW HeapAlloc CreateThread OpenSemaphoreW WaitForSingleObjectEx LoadLibraryA CreateFileA OutputDebugStringW GetLastError FormatMessageW Sleep ProcessIdToSessionId MultiByteToWideChar OpenProcess GetModuleHandleA ReleaseMutex EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary QueryPerformanceCounter GetTickCount WideCharToMultiByte MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType ReadFile GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetComputerNameA PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoA GetFileSizeEx InitializeSListHead CloseHandle GetModuleFileNameA CreateSemaphoreExW HeapFree SetLastError GetCurrentProcess ReleaseSemaphore GetModuleHandleExW OutputDebugStringA TerminateProcess GetModuleFileNameW GetVolumeInformationA WaitForSingleObject LocalAlloc GetCurrentThreadId lstrcmpA GetProcAddress

user32

GetWindow DispatchMessageA GetWindowRect LoadCursorA DestroyWindow SetWindowPos MessageBoxW keybd_event LoadStringA CallNextHookEx GetSystemMetrics ShowWindow SetWindowLongA SetProcessDPIAware ChangeDisplaySettingsA GetWindowLongA SetWindowDisplayAffinity MessageBoxA EnumDisplaySettingsA UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage LoadIconA GetClientRect PostQuitMessage RegisterClassExA UpdateWindow BeginPaint EndPaint LoadAcceleratorsA TranslateAcceleratorA GetAsyncKeyState GetMessageA SetWindowsHookExA

shell32

SHGetFolderPathA

ole32

CoTaskMemFree CoTaskMemAlloc

oleaut32

SysFreeString

wtsapi32

WTSEnumerateProcessesA WTSFreeMemory

cpprest141_2_10

?boolean@value@json@web@@SA?AV123@_N@Z ?number@value@json@web@@SA?AV123@I@Z ?parse@value@json@web@@SA?AV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?serialize@value@json@web@@QBEXAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@@Z ??4value@json@web@@QAEAAV012@$$QAV012@@Z ??0value@json@web@@QAE@H@Z ??0value@json@web@@QAE@ABV012@@Z ?as_integer@value@json@web@@QBEHXZ ??4value@json@web@@QAEAAV012@ABV012@@Z ??Avalue@json@web@@QAEAAV012@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?as_number@value@json@web@@QBEABVnumber@23@XZ ?as_bool@value@json@web@@QBE_NXZ ?as_string@value@json@web@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ ?erase@value@json@web@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?at@value@json@web@@QAEAAV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

msvcp140

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Xlength_error@std@@YAXPBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?good@ios_base@std@@QBE_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

urlmon

CreateUri

mpr

WNetGetProviderNameA

vcruntime140

memcpy strchr strrchr memmove memchr _except_handler4_common __current_exception __current_exception_context _CxxThrowException memset _purecall __std_exception_copy __std_exception_destroy strstr __std_terminate __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_errno _configure_wide_argv _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn system _cexit _invalid_parameter_noinfo _crt_atexit _register_onexit_function _initialize_onexit_table exit _register_thread_local_exe_atexit_callback _c_exit terminate strerror _get_wide_winmain_command_line __sys_nerr _initterm _exit _initterm_e _getpid _initialize_wide_environment _beginthreadex _controlfp_s

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc _set_new_mode free calloc

api-ms-win-crt-string-l1-1-0

strpbrk toupper strncpy _strdup strcspn strspn tolower strncmp isupper

api-ms-win-crt-stdio-l1-1-0

_read _lseeki64 _write fputc fflush _set_fmode fopen _close __acrt_iob_func _open fclose fseek feof __stdio_common_vsscanf fputs __p__commode fwrite fread __stdio_common_vfprintf_s __stdio_common_vsnprintf_s fgets __stdio_common_vsprintf __stdio_common_vswprintf ftell

api-ms-win-crt-math-l1-1-0

__setusermatherr _dsign _dclass

api-ms-win-crt-convert-l1-1-0

strtoll atoi strtoull strtoul strtod strtol wcstombs

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_access _unlink _fstat64 _stat64

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CertGetNameStringA CertAddCertificateContextToStore CryptDecodeObjectEx CertFindExtension