Detention_Request_Shipper_Detention_Time_Confirmation[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Detention_Request_Shipper_Detention_Time_Confirmation.exe
Size 440KB
Sample260916-rx47lswt7j
SHA256 a4514ad23234dbbe40df14dfa9b1259d4c9d314561b681ac85b91feaa9edceae
MD5 f3002b8735e6ecb6a98ac22824fdbb62
SHA1 3fb5212b4244fe5cfa15740cbfb89cc510ca6189
SHA512 7d9c4c3a2e982add9867e158f9129339856eb7796319ea9f477b9151c7169aa6c5059450fee23f495fa97148a9181e68555eb70d370cf16bf9b92782db7b03b9
SSDEEP 6144:mEso1pgdV8rNe4DzMoRuxQqPe1SQJIZL8SunzDbKvb:mEso88peCzwCq5ID
TLSH
T158A4CE49FA43C9E4FA57323510716C162F52DC8E5B952ACF248EF6A23C722D2407BDB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Detention_Request_Shipper_Detention_Time_Confirmation.exe

File Explorer

Detention_Request_Shipper_Detention_Time_Confirmation.exe

.exe 440KB

Detention_Request_Shipper_Detention_Time_Confirmation.exe

IMPHASH 75d135a53e9410145c57a9e47a548250
SHA256 a4514ad23234dbbe40df14dfa9b1259d4c9d314561b681ac85b91feaa9edceae
MD5 f3002b8735e6ecb6a98ac22824fdbb62
SHA1 3fb5212b4244fe5cfa15740cbfb89cc510ca6189
SHA512 7d9c4c3a2e982add9867e158f9129339856eb7796319ea9f477b9151c7169aa6c5059450fee23f495fa97148a9181e68555eb70d370cf16bf9b92782db7b03b9
SSDEEP 6144:mEso1pgdV8rNe4DzMoRuxQqPe1SQJIZL8SunzDbKvb:mEso88peCzwCq5ID
TLSH
T158A4CE49FA43C9E4FA57323510716C162F52DC8E5B952ACF248EF6A23C722D2407BDB6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5525

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler AreFileApisANSI CloseThreadpoolCleanupGroup CloseThreadpoolWork CreateActCtxW CreateTimerQueue DelayLoadFailureHook DeleteCriticalSection FindResourceExA FindResourceExW FindVolumeClose FormatMessageW GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesExA GetFullPathNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPackageFamilyName GetProcAddress GetProcessHeap GetProductInfo GetSystemDefaultLangID GetThreadPriorityBoost GetTickCount GetTimeZoneInformation GetUserDefaultLangID GlobalReAlloc HeapAlloc HeapFree IsWow64Process2 K32GetProcessImageFileNameW LoadLibraryA OutputDebugStringA ProcessIdToSessionId RemoveVectoredExceptionHandler ReplaceFileW SetEnvironmentVariableA SetFileAttributesA SetThreadInformation SetThreadPreferredUILanguages SetThreadUILanguage Sleep SystemTimeToTzSpecificLocalTime UnlockFileEx VirtualAlloc VirtualFree VirtualProtect WTSGetActiveConsoleSessionId WriteConsoleW

user32

BeginPaint CheckMenuRadioItem EnumChildWindows EnumDesktopsW GetCapture GetFocus GetMenuItemID GetRawInputData GetSubMenu GetSystemMetrics InvalidateRgn IsIconic LockWorkStation ModifyMenuW PostQuitMessage ReleaseCapture ScrollWindow SendMessageTimeoutW SendNotifyMessageW SetCaretPos SetForegroundWindow SetMenuDefaultItem SetTimer ShowCursor TranslateAcceleratorW UnhookWinEvent

advapi32

AddAccessDeniedAce CloseServiceHandle ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyKey EnableTraceEx2 GetLengthSid GetUserNameW MapGenericMask RegCreateKeyA RegDeleteValueA RegQueryValueExA SetSecurityDescriptorDacl

gdi32

BitBlt CreateSolidBrush GdiFlush GetCurrentObject GetTextExtentPoint32W SetBrushOrgEx SetTextAlign

ntdll

EtwEventActivityIdControl LdrGetDllHandle LdrLoadDll NtAlpcCreatePort NtClose NtCreateFile NtCreateSection NtSetInformationKey RtlAppendUnicodeStringToString RtlCheckRegistryKey RtlCreateUnicodeString RtlDeleteRegistryValue RtlFreeSid RtlGUIDFromString RtlInitializeResource RtlIpv4AddressToStringA RtlIpv4AddressToStringExW RtlLeaveCriticalSection RtlQueryInformationAcl RtlRaiseStatus RtlSetDaclSecurityDescriptor RtlSubAuthorityCountSid RtlUnsubscribeWnfNotificationWaitForCompletion TpCancelAsyncIoOperation TpWaitForIoCompletion ZwCreateSection ZwLoadKey ZwOpenFile ZwOpenSymbolicLinkObject ZwQueryDirectoryObject

crypt32

CertCreateCertificateContext CertEnumCRLsInStore CryptEncodeObjectEx CryptExportPublicKeyInfoEx

imagehlp

CheckSumMappedFile

gdiplus

GdiplusShutdown

rpcrt4

RpcEpUnregister RpcObjectSetType RpcRevertToSelfEx UuidEqual UuidFromStringW

shell32

ExtractIconExW SHAppBarMessage SHBrowseForFolderW SHCreateItemFromIDList SHGetMalloc SHGetSpecialFolderLocation ShellExecuteW

ole32

CoAllowSetForegroundWindow CoGetClassObject CoInitialize CoTaskMemFree CoTaskMemRealloc CoUninitialize

uxtheme

DrawThemeBackground GetThemeColor

iphlpapi

ConvertInterfaceLuidToGuid ConvertInterfaceLuidToNameW GetIpStatisticsEx IcmpSendEcho

imm32

ImmAssociateContext

wintrust

CryptCATAdminEnumCatalogFromHash

setupapi

SetupFindNextLine

bcrypt

BCryptGenRandom

shlwapi

PathParseIconLocationW

wininet

HttpQueryInfoW