41210414[.]exe[.]exe

General

Target
41210414.exe.exe
Size 578KB
Sample260910-swbdksde92
SHA256 a0fe765dcc9c1595b8235c3a90601ca1df14a551a9597829ad85e0f99423f91d
MD5 bfaef7856f6a0fbdd3167638ad04bc54
SHA1 75918bcf75d2e32f617449f6f7e24a033a25cefa
SHA512 5347a9ba72593c3daf33577359d9a514e3045d96bbd7efba1c7201550da61750f266746675820c5a0f362c81f0b27d35ecacdd307cf56196b4ba92e2b5520807
SSDEEP 12288:BrqUzrF17Da8BOAEyiF7nWCNaSrgGkPNIMXoiIaZkwrwE5Jh1AYa:BrVF1Ha8kyMnNaSrgGkPNIMXoiIIkwrv
TLSH
T191C4E166A74805FCD59D94328DC51A35BAAA7803973018DF02A504897FEBFC19F7EB38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41210414.exe.exe

File Explorer

41210414.exe.exe

.exe 578KB

41210414.exe.exe

IMPHASH 334f364b96e3a3131ca106408f125bab
SHA256 a0fe765dcc9c1595b8235c3a90601ca1df14a551a9597829ad85e0f99423f91d
MD5 bfaef7856f6a0fbdd3167638ad04bc54
SHA1 75918bcf75d2e32f617449f6f7e24a033a25cefa
SHA512 5347a9ba72593c3daf33577359d9a514e3045d96bbd7efba1c7201550da61750f266746675820c5a0f362c81f0b27d35ecacdd307cf56196b4ba92e2b5520807
SSDEEP 12288:BrqUzrF17Da8BOAEyiF7nWCNaSrgGkPNIMXoiIaZkwrwE5Jh1AYa:BrVF1Ha8kyMnNaSrgGkPNIMXoiIIkwrv
TLSH
T191C4E166A74805FCD59D94328DC51A35BAAA7803973018DF02A504897FEBFC19F7EB38
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

48000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rhuastimiuys.pdb

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile RtlGetVersion

kernel32

GetOEMCP GetTickCount QueryPerformanceFrequency TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode ReleaseSRWLockExclusive GetLogicalDrives GetSystemTimeAsFileTime GetTickCount64 GetCurrentThread GetNativeSystemInfo GetVersion CloseHandle GetLastError WriteConsoleW GetProcessHeap HeapFree SetLastError GetActiveProcessorGroupCount IsProcessorFeaturePresent GetConsoleWindow GetFileType GetConsoleOutputCP HeapReAlloc CreateFileW SetFileTime GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx SetFileInformationByHandle MultiByteToWideChar WaitForSingleObject LoadLibraryA SetFilePointerEx FlushFileBuffers HeapSize GetProcAddress GetModuleHandleA GetCPInfo IsDBCSLeadByte HeapAlloc SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW WriteFile

user32

GetSysColor GetSystemMetrics GetCaretBlinkTime

winmm

waveInGetNumDevs midiOutGetNumDevs joyGetNumDevs midiInGetNumDevs mixerGetNumDevs

Sharing