077da46ddd4a0ef891926d7666667d3f837e4ef6a76c05bf61e0ff1b8ea48e2c[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
077da46ddd4a0ef891926d7666667d3f837e4ef6a76c05bf61e0ff1b8ea48e2c.exe
Size 122KB
Sample260901-qt7ynazele
SHA256 077da46ddd4a0ef891926d7666667d3f837e4ef6a76c05bf61e0ff1b8ea48e2c
MD5 3da54a64d98decc62e035cc18db2e03e
SHA1 820ada8f026a448dcb88f288197ebaa8ed3673ea
SHA512 46890d64272a428b6f4d2d51ba55018040d5857d7efea24c153063e0ae76a95623b702697744288962c975354bf1a8a43235661a7c2f853f1da09ba5eb198e64
SSDEEP 1536:4D3jKv4yPEwnPAg+W502YUe4gHFu7VmPZA//XjU6RpXBlMPZI6pvuJ4:QpyRPGOlteXFuMPK//XjU6RpXAq6puJ
TLSH
T19CC32A17BAA8017DE2F6D67DD9E28812EB727C49479167CF07804DA74E326D0EE39702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
077da46ddd4a0ef891926d7666667d3f837e4ef6a76c05bf61e0ff1b8ea48e2c.exe

File Explorer

077da46ddd4a0ef891926d7666667d3f837e4ef6a76c05bf61e0ff1b8ea48e2c.exe

.exe 122KB

077da46ddd4a0ef891926d7666667d3f837e4ef6a76c05bf61e0ff1b8ea48e2c.exe

IMPHASH 8fc11c2c6de887de81bbe39813e94b7a
SHA256 077da46ddd4a0ef891926d7666667d3f837e4ef6a76c05bf61e0ff1b8ea48e2c
MD5 3da54a64d98decc62e035cc18db2e03e
SHA1 820ada8f026a448dcb88f288197ebaa8ed3673ea
SHA512 46890d64272a428b6f4d2d51ba55018040d5857d7efea24c153063e0ae76a95623b702697744288962c975354bf1a8a43235661a7c2f853f1da09ba5eb198e64
SSDEEP 1536:4D3jKv4yPEwnPAg+W502YUe4gHFu7VmPZA//XjU6RpXBlMPZI6pvuJ4:QpyRPGOlteXFuMPK//XjU6RpXAq6puJ
TLSH
T19CC32A17BAA8017DE2F6D67DD9E28812EB727C49479167CF07804DA74E326D0EE39702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\carso\source\repos\Project17\x64\Release\Project17.pdb

kernel32

GetModuleHandleW CopyFileW WideCharToMultiByte GlobalUnlock GetDriveTypeW GetComputerNameA FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind CreateProcessW RtlCaptureContext GetFileInformationByHandleEx GetLastError AreFileApisANSI GetFileAttributesExW GlobalLock CloseHandle DeleteFileW Process32FirstW GetCurrentThread Process32NextW GetTickCount64 Sleep CreateToolhelp32Snapshot GetLogicalDriveStringsW OpenProcess CreateFileW WaitForSingleObject SetThreadPriority GetModuleFileNameW TerminateProcess VirtualAlloc RtlLookupFunctionEntry WriteFile FindNextFileW GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW LocalFree

user32

InvalidateRect SetWindowPos GetAsyncKeyState ShowWindow GetWindowLongPtrW GetDlgItemTextA GetSystemMetrics DispatchMessageW SetTimer RedrawWindow CloseClipboard RegisterClassW MessageBoxA EndPaint TranslateMessage DestroyWindow DefWindowProcW GetMessageW SetForegroundWindow CreateWindowExW UpdateWindow SetWindowLongPtrW PostQuitMessage KillTimer DrawTextW BeginPaint GetDlgItem GetClientRect GetClipboardData BlockInput FillRect OpenClipboard

gdi32

SetBkColor CreateSolidBrush SetTextColor

advapi32

CryptDestroyKey RegCloseKey CryptAcquireContextW CryptEncrypt AllocateAndInitializeSid RegCreateKeyExW RegSetValueExW FreeSid CheckTokenMembership RegOpenKeyExW RegCreateKeyW CryptSetKeyParam CryptImportKey CryptReleaseContext

shell32

SHGetFolderPathW

msvcp140

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Winerror_map@std@@YAHH@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xout_of_range@std@@YAXPEBD@Z

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpAddRequestHeaders

wlanapi

WlanCloseHandle WlanOpenHandle WlanDisconnect

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcmp strstr __std_terminate __std_exception_copy __std_exception_destroy memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_c_exit _initterm _register_thread_local_exe_atexit_callback _exit _get_narrow_winmain_command_line _initterm_e abort _set_app_type _seh_filter_exe _cexit _crt_atexit terminate _beginthreadex _invoke_watson _register_onexit_function exit _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fputc fgetc fclose fgetpos __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc fwrite setvbuf fflush

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscat_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr