feffddf7161d20788b039e866d25d98b1bc2c2b395fe148311fcbb6dddc64041[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
feffddf7161d20788b039e866d25d98b1bc2c2b395fe148311fcbb6dddc64041.exe
Size 1.1MB
Sample260910-mtk74svxdw
SHA256 feffddf7161d20788b039e866d25d98b1bc2c2b395fe148311fcbb6dddc64041
MD5 f52c4d7d97b4eb93a2a235c52b9d3d54
SHA1 b25cc9f336065dc16b09e75bf99c9150ab3850f2
SHA512 d9dc99076f49aa15a98b7a5e6ce793e1d553d6ce7235b2866554bfbdb0f22f0dc2063868dc9323633d70bacba2249aab5d7c03b4185876db6b6a717cbcf196c0
SSDEEP 24576:uhS1vsyzK2pP732C6RY5fVqr02esyuu5AKLfJVB:ukvsq+e58rFeEyLP
TLSH
T1E6359D18E38811ECE527C674CBA69232F775B4460761B9DB1BDAD6152F73AE02F3A301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
feffddf7161d20788b039e866d25d98b1bc2c2b395fe148311fcbb6dddc64041.exe

File Explorer

feffddf7161d20788b039e866d25d98b1bc2c2b395fe148311fcbb6dddc64041.exe

.exe 1.1MB

feffddf7161d20788b039e866d25d98b1bc2c2b395fe148311fcbb6dddc64041.exe

IMPHASH 8c0ed5311e0eeba51b4c1a13e4263081
SHA256 feffddf7161d20788b039e866d25d98b1bc2c2b395fe148311fcbb6dddc64041
MD5 f52c4d7d97b4eb93a2a235c52b9d3d54
SHA1 b25cc9f336065dc16b09e75bf99c9150ab3850f2
SHA512 d9dc99076f49aa15a98b7a5e6ce793e1d553d6ce7235b2866554bfbdb0f22f0dc2063868dc9323633d70bacba2249aab5d7c03b4185876db6b6a717cbcf196c0
SSDEEP 24576:uhS1vsyzK2pP732C6RY5fVqr02esyuu5AKLfJVB:ukvsq+e58rFeEyLP
TLSH
T1E6359D18E38811ECE527C674CBA69232F775B4460761B9DB1BDAD6152F73AE02F3A301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

734784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DeregisterEventSource

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CompareStringEx CompareStringOrdinal CreateEventExW DuplicateHandle FindNLSStringEx FindStringOrdinal FormatMessageW GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetLocaleInfoEx GetModuleFileNameW GetModuleHandleW GetStdHandle GetThreadPriority LCMapStringEx LoadLibraryExW LocalFree LocaleNameToLCID MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ResolveLocaleName SetEvent SetLastError SetThreadErrorMode Sleep SleepEx VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetProcAddress RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak WaitForSingleObject GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent GetSystemTimeAsFileTime FlushProcessWriteBuffers InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoInitializeEx CoGetApartmentType CoUninitialize CoWaitForMultipleHandles

api-ms-win-crt-heap-l1-1-0

_callnewh free calloc malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

log __setusermatherr

api-ms-win-crt-string-l1-1-0

_stricmp strcpy strlen strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf_s __p__commode __stdio_common_vsscanf __stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table abort _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv terminate __p___argc _exit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale