4d28296e8ff7f9616997a465ac85b13399bf398fb561431e0ff5a740cb7fd3c7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4d28296e8ff7f9616997a465ac85b13399bf398fb561431e0ff5a740cb7fd3c7.exe
Size 332KB
Sample260831-b3mlratare
SHA256 4d28296e8ff7f9616997a465ac85b13399bf398fb561431e0ff5a740cb7fd3c7
MD5 211394f81556f64e9823cbd2a5fc1969
SHA1 7303ac5250721efe1d4de6118f467d04001a2be8
SHA512 6b06d17cac734bd9064f473bb96bf8126b21c010dc9a6491dd764fe8cde3c0678632d069136d8c1b85005a576d3e226370c293fa4403712e706c64cbe0f784c2
SSDEEP 6144:axFm8jr8dmxZc+92bOiRRFsuNfgKk5H4RlANeKmFDhkMt:axY8H8dmxWWBivFBNGH4cNQR1t
TLSH
T1B674CF3331B8F25EC84517728F62C7C263A97F55C992805F3EB4630F2A278595A36B36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d28296e8ff7f9616997a465ac85b13399bf398fb561431e0ff5a740cb7fd3c7.exe

File Explorer

4d28296e8ff7f9616997a465ac85b13399bf398fb561431e0ff5a740cb7fd3c7.exe

.exe 332KB

4d28296e8ff7f9616997a465ac85b13399bf398fb561431e0ff5a740cb7fd3c7.exe

IMPHASH 551920a564f0da077e7c568c1940defb
SHA256 4d28296e8ff7f9616997a465ac85b13399bf398fb561431e0ff5a740cb7fd3c7
MD5 211394f81556f64e9823cbd2a5fc1969
SHA1 7303ac5250721efe1d4de6118f467d04001a2be8
SHA512 6b06d17cac734bd9064f473bb96bf8126b21c010dc9a6491dd764fe8cde3c0678632d069136d8c1b85005a576d3e226370c293fa4403712e706c64cbe0f784c2
SSDEEP 6144:axFm8jr8dmxZc+92bOiRRFsuNfgKk5H4RlANeKmFDhkMt:axY8H8dmxWWBivFBNGH4cNQR1t
TLSH
T1B674CF3331B8F25EC84517728F62C7C263A97F55C992805F3EB4630F2A278595A36B36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

292432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement GetCurrentProcess HeapFree Process32First SetHandleInformation WaitForSingleObject SetEvent GetTickCount GetProcessHeap GetSystemTimeAsFileTime WriteFile GetDriveTypeA GetProcessTimes OpenProcess GlobalAlloc WideCharToMultiByte TerminateThread Sleep CopyFileW ReadProcessMemory CreateEventA SetConsoleCP GetComputerNameExA CreateProcessA TerminateProcess FileTimeToSystemTime ReadFile GetModuleFileNameW CreateFileW MultiByteToWideChar CreateDirectoryA SetCurrentDirectoryA InterlockedIncrement GetLastError SetLastError GetProcAddress CopyFileA FindClose LoadLibraryA Process32Next SetConsoleOutputCP GetSystemInfo CreatePipe GetModuleFileNameA FindNextFileA GetModuleHandleA FindNextFileW GetCurrentDirectoryA CreateToolhelp32Snapshot GetDiskFreeSpaceExA GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId LocalFree GetSystemTime DeleteFileA CreateThread GetCurrentThreadId SetEndOfFile VirtualQuery GetLocaleInfoW SetEnvironmentVariableA HeapAlloc CreateProcessW lstrlenA FindFirstFileW ExitProcess CreateFileA GetComputerNameA FindFirstFileA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle DebugBreak IsValidLocale TlsFree TlsSetValue TlsAlloc TlsGetValue GetStdHandle VirtualAlloc VirtualFree EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID FlushFileBuffers GetStringTypeA InitializeCriticalSectionAndSpinCount FreeLibrary SetFilePointer GetConsoleMode GetConsoleCP GetTimeZoneInformation QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize IsValidCodePage GetOEMCP InterlockedCompareExchange InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetTimeFormatA GetDateFormatA HeapReAlloc GetModuleHandleW GetCPInfo RaiseException RtlUnwind LCMapStringW LCMapStringA GetStringTypeW HeapCreate GetACP

user32

wsprintfA

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges GetSecurityInfo LookupAccountSidA GetTokenInformation GetUserNameW OpenProcessToken

shell32

ShellExecuteA

ole32

CoUninitialize CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantChangeType VariantInit SysAllocStringByteLen VariantClear SysStringLen SysAllocString

ws2_32

setsockopt recv bind socket htons closesocket send listen accept select inet_addr WSAStartup inet_ntoa gethostname connect __WSAFDIsSet ioctlsocket gethostbyname

psapi

EnumProcesses

Name

.text

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.stub

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

24.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4d28296e8ff7f9616997a465ac85b13399bf398fb561431e0ff5a740cb7fd3c7.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

psapi

generic