tmpeqef4rz7[.]tmp[.]exe

General

Target
tmpeqef4rz7.tmp.exe
Size 115KB
Sample260828-rn3mesygnb
SHA256 9910c262ea4d1779036a8dfb81aa013b7c0d64e5cb1b0c37e3136a6ae2914e00
MD5 93a7e50fdf9c2306bebcb9e46e875dc7
SHA1 3af34604b38f08ccc3bfc3734e128cf64e398f10
SHA512 3febf091e6a4d33b469d3599e84f36ea4cf2691e2b90a972a37a943c99f5ef4e3453d8293fdf339a71e2b6476fb56457ac9b52fccf2d5bf91b9dffc0d531023e
SSDEEP 3072:v5CRmculaRYGGwV6Zp8ki9DEE48bLEzbi:v5Hc4TL46ZmkkEqXge
TLSH
T12EB34C5B73A510BBE177823884A34A46E772BC161761AFEF03A046561F237E19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpeqef4rz7.tmp.exe

File Explorer

tmpeqef4rz7.tmp.exe

.dll 115KB

tmpeqef4rz7.tmp.exe

IMPHASH 6b2d705473ac9543817a26d7c7dcda77
SHA256 9910c262ea4d1779036a8dfb81aa013b7c0d64e5cb1b0c37e3136a6ae2914e00
MD5 93a7e50fdf9c2306bebcb9e46e875dc7
SHA1 3af34604b38f08ccc3bfc3734e128cf64e398f10
SHA512 3febf091e6a4d33b469d3599e84f36ea4cf2691e2b90a972a37a943c99f5ef4e3453d8293fdf339a71e2b6476fb56457ac9b52fccf2d5bf91b9dffc0d531023e
SSDEEP 3072:v5CRmculaRYGGwV6Zp8ki9DEE48bLEzbi:v5Hc4TL46ZmkkEqXge
TLSH
T12EB34C5B73A510BBE177823884A34A46E772BC161761AFEF03A046561F237E19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileA ReadFile WriteFile CloseHandle Sleep GetCurrentProcessId CreateThread DisableThreadLibraryCalls GetModuleFileNameA lstrcpyA WaitNamedPipeA WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle HeapReAlloc HeapSize QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx InterlockedFlushSList GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW IsProcessorFeaturePresent HeapAlloc HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW

user32

wsprintfA

ole32

CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString SysStringByteLen SysAllocStringByteLen

Name

.text

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmpeqef4rz7.tmp.exe

kernel32

user32

ole32

oleaut32

generic