b657a4f887fa6c5fc0cda1b4809ffe9d03d63f110fa6bd88b828ee2ad8eb3e08[.]exe

General

Target
b657a4f887fa6c5fc0cda1b4809ffe9d03d63f110fa6bd88b828ee2ad8eb3e08.exe
Size 572KB
Sample260911-rvb32sgk21
SHA256 b657a4f887fa6c5fc0cda1b4809ffe9d03d63f110fa6bd88b828ee2ad8eb3e08
MD5 4298412221e0a0028900890b8f274c70
SHA1 ccd531621e7fc3b5e0a6f33f4559676f773458a7
SHA512 f0beb4d1279940550f3eb77cd96603f1c74b865b3ffcd85b8668eeaf1062aaa2114720bdc311b875c89f842dbaf3626dc24609f96403d1b0c14bd1f4be0a9035
SSDEEP 12288:Y+EhwtIygPJ3lhwwl6D+1OmNOEXRPgWbesrD:YEDcxlhR6DiOmLhPbrD
TLSH
T16BC4E106EF9585FDC025803BCA65C636FBB3B44A07906BEF439405151E9AAC83FB9F64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b657a4f887fa6c5fc0cda1b4809ffe9d03d63f110fa6bd88b828ee2ad8eb3e08.exe

File Explorer

b657a4f887fa6c5fc0cda1b4809ffe9d03d63f110fa6bd88b828ee2ad8eb3e08.exe

.exe 572KB

b657a4f887fa6c5fc0cda1b4809ffe9d03d63f110fa6bd88b828ee2ad8eb3e08.exe

IMPHASH 986023209c8ed59c320fae227999d87c
SHA256 b657a4f887fa6c5fc0cda1b4809ffe9d03d63f110fa6bd88b828ee2ad8eb3e08
MD5 4298412221e0a0028900890b8f274c70
SHA1 ccd531621e7fc3b5e0a6f33f4559676f773458a7
SHA512 f0beb4d1279940550f3eb77cd96603f1c74b865b3ffcd85b8668eeaf1062aaa2114720bdc311b875c89f842dbaf3626dc24609f96403d1b0c14bd1f4be0a9035
SSDEEP 12288:Y+EhwtIygPJ3lhwwl6D+1OmNOEXRPgWbesrD:YEDcxlhR6DiOmLhPbrD
TLSH
T16BC4E106EF9585FDC025803BCA65C636FBB3B44A07906BEF439405151E9AAC83FB9F64
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

50480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mciormaff.pdb

kernel32

TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode ReleaseSRWLockExclusive CreateFileW SetFileTime GetLastError SetLastError GetFullPathNameW GetActiveProcessorCount GetCurrentProcessorNumber GetProcessHeaps HeapSize GetMaximumProcessorCount IsProcessorFeaturePresent GetModuleHandleA GetProcAddress GetFileInformationByHandleEx GetCurrentThread GetSystemDirectoryW GetCurrentDirectoryW GetProcessHeap HeapReAlloc WriteConsoleW GetCPInfo IsDBCSLeadByte GetConsoleWindow QueryPerformanceFrequency QueryPerformanceCounter GetConsoleOutputCP HeapFree HeapAlloc WaitForSingleObject CloseHandle LoadLibraryA GetFileType MultiByteToWideChar SetFileInformationByHandle GetFileInformationByHandle SetFilePointerEx GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW FlushFileBuffers WriteFile

ntdll

NtReadFile RtlGetVersion RtlNtStatusToDosError NtWriteFile

Sharing