e_b5e3f9c1a7d4_decrypted[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
e_b5e3f9c1a7d4_decrypted.bin.exe
Size 2.4MB
Sample260916-1kekvszz7p
SHA256 7b7e09f308b5b5bdd5feb425b370748767a975134de95d8130107af3909b1572
MD5 8e9a1af5fc3d198e2acf5ccafa04ee00
SHA1 8b7ef6f5e5a9b0444f340e3060a4e50cc64efda9
SHA512 d1f71f0cb01b0a5eaaba52b115eb4b99d011fb254c9a646ed14005251e29d4954be9b2ceb6e74304d5a957999722077a13c732ee0afbf456988bc83ecc7e2023
SSDEEP 24576:igmxhOZNhsYKcrVrclSbjgSpO++q6IitHDZ54Ovn93Sq1DEj1B4FMXVIH06iyWj3:uzENhsFcrVrmSHLQv93SuYW4IU6iRV
TLSH
T14FC56C43F6A280E8C16AC4B4835A6633FA72BC8D473076EB57D45B243E66FD06A3C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e_b5e3f9c1a7d4_decrypted.bin.exe

File Explorer

e_b5e3f9c1a7d4_decrypted.bin.exe

.exe 2.4MB

e_b5e3f9c1a7d4_decrypted.bin.exe

IMPHASH ddb3915ffcb2e7709b02cf841963eac4
SHA256 7b7e09f308b5b5bdd5feb425b370748767a975134de95d8130107af3909b1572
MD5 8e9a1af5fc3d198e2acf5ccafa04ee00
SHA1 8b7ef6f5e5a9b0444f340e3060a4e50cc64efda9
SHA512 d1f71f0cb01b0a5eaaba52b115eb4b99d011fb254c9a646ed14005251e29d4954be9b2ceb6e74304d5a957999722077a13c732ee0afbf456988bc83ecc7e2023
SSDEEP 24576:igmxhOZNhsYKcrVrclSbjgSpO++q6IitHDZ54Ovn93Sq1DEj1B4FMXVIH06iyWj3:uzENhsFcrVrmSHLQv93SuYW4IU6iRV
TLSH
T14FC56C43F6A280E8C16AC4B4835A6633FA72BC8D473076EB57D45B243E66FD06A3C715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1621724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RuntimeBroker.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

advapi32

SetTokenInformation SystemFunction036 AdjustTokenPrivileges LookupPrivilegeValueW FreeSid SetSecurityInfo SetEntriesInAclW AllocateAndInitializeSid OpenProcessToken GetTokenInformation DuplicateTokenEx CreateProcessAsUserW GetSecurityInfo

kernel32

GetProcessHeap HeapFree GetSystemTimePreciseAsFileTime OpenProcess GetLastError TerminateProcess CloseHandle WTSGetActiveConsoleSessionId GetCurrentProcess SetLastError CreateMutexW GetCurrentProcessId LocalFree Sleep CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject SetFilePointerEx QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetStdHandle GetConsoleMode GetConsoleOutputCP GetFileSizeEx HeapSize MultiByteToWideChar WriteConsoleW GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetEnvironmentVariableW HeapAlloc CreateDirectoryW GetFullPathNameW FindFirstFileExW FindClose CreateFileW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx FlushFileBuffers GetModuleHandleW FormatMessageW GetModuleHandleA GetModuleFileNameW GetTempPathW LCMapStringW CompareStringW LoadLibraryExW SetHandleInformation VirtualProtect DeleteFileW CreateThread WriteFileEx SleepEx ReadFileEx CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle GetExitCodeProcess GetStringTypeW SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW OutputDebugStringW UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryExA GetCommandLineW GetCommandLineA FreeLibrary ExitProcess WriteFile GetModuleHandleExW GetFileType GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock GetUserProfileDirectoryW

ntdll

NtReadFile NtOpenFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ws2_32

getpeername freeaddrinfo getaddrinfo accept bind WSASend listen WSARecv connect setsockopt ioctlsocket getsockopt closesocket WSASocketW WSACleanup WSAStartup WSAGetLastError getsockname select recv send WSADuplicateSocketW

oleaut32

SysFreeString SysStringLen

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

687KB

Virtual Size

686KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e_b5e3f9c1a7d4_decrypted.bin.exe

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

kernel32

wtsapi32

userenv

ntdll

ws2_32

oleaut32

generic