592627c6d8f01519d9a88923db6fab9d65314ac0a9c43b2d75da8882995042b3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
592627c6d8f01519d9a88923db6fab9d65314ac0a9c43b2d75da8882995042b3.exe
Size 1.7MB
Sample260922-wl9eeacb43
SHA256 592627c6d8f01519d9a88923db6fab9d65314ac0a9c43b2d75da8882995042b3
MD5 3be7d0a33622dbfead5a675a90d1ebfd
SHA1 eb6546e7e17513a9b2b9f8d8bafcc9775d3bf20c
SHA512 9a653476e26952816ebaa88958b89cf4d0f76a6612139a1ef066dc72870a95776905cb3ab0a6ba34dabbc24cd0f146a91b671c96780eeab346b42d503b948cae
SSDEEP 24576:7cvN8WuR8mvUn0RN9oe4meM5loC+R+uPfJAHhI+4FA0bLUw:7c11mc0RnSmqXiHhI+/0b4w
TLSH
T1FD852843F66690FCC069C075930A6633BE32BC8D4B2576FB5AD44B312E65FA06A3CB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
592627c6d8f01519d9a88923db6fab9d65314ac0a9c43b2d75da8882995042b3.exe

File Explorer

592627c6d8f01519d9a88923db6fab9d65314ac0a9c43b2d75da8882995042b3.exe

.exe 1.7MB

592627c6d8f01519d9a88923db6fab9d65314ac0a9c43b2d75da8882995042b3.exe

IMPHASH 698d9f6f1b43008aed8650a66c25ee70
SHA256 592627c6d8f01519d9a88923db6fab9d65314ac0a9c43b2d75da8882995042b3
MD5 3be7d0a33622dbfead5a675a90d1ebfd
SHA1 eb6546e7e17513a9b2b9f8d8bafcc9775d3bf20c
SHA512 9a653476e26952816ebaa88958b89cf4d0f76a6612139a1ef066dc72870a95776905cb3ab0a6ba34dabbc24cd0f146a91b671c96780eeab346b42d503b948cae
SSDEEP 24576:7cvN8WuR8mvUn0RN9oe4meM5loC+R+uPfJAHhI+4FA0bLUw:7c11mc0RnSmqXiHhI+/0b4w
TLSH
T1FD852843F66690FCC069C075930A6633BE32BC8D4B2576FB5AD44B312E65FA06A3CB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1422956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

zionsiphon.pdb

kernel32

WriteConsoleW GetFullPathNameW GetFileInformationByHandleEx FindFirstFileExW CreateFileW SetFileTime SetFileInformationByHandle GetTempPathW CreateMutexA GetCurrentProcessId SetHandleInformation WaitForSingleObjectEx DeleteFileW CopyFileExW GetFileType GetCurrentThreadId WriteFileEx SleepEx ReadFileEx ExitProcess GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW SetFileAttributesW WaitForSingleObject GetExitCodeProcess GetComputerNameExW InitializeSListHead FindNextFileW GetProcessTimes OpenProcess GetSystemTimes GetProcessIoCounters GetDriveTypeW GetCurrentProcess CreateThread GetSystemInfo GetFileInformationByHandle LocalFree GetVolumeInformationW GetVolumePathNamesForVolumeNameW GetDiskFreeSpaceExW DeviceIoControl GetFinalPathNameByHandleW SetFileCompletionNotificationModes FreeLibrary CreateIoCompletionPort GetLastError GetQueuedCompletionStatusEx FindClose GetSystemTimePreciseAsFileTime ReleaseMutex SwitchToThread GetProcessHeap HeapFree GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetStdHandle QueryPerformanceCounter HeapReAlloc GetCommandLineW IsDebuggerPresent CheckRemoteDebuggerPresent GetUserDefaultUILanguage GetCurrentThread AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA lstrlenW WideCharToMultiByte MultiByteToWideChar HeapAlloc GetEnvironmentVariableW GetModuleHandleW FormatMessageW GetModuleFileNameW QueryPerformanceFrequency GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal ReadProcessMemory SetThreadStackGuarantee PostQueuedCompletionStatus GetConsoleOutputCP IsProcessorFeaturePresent VirtualQueryEx GetSystemTimeAsFileTime FindVolumeClose LoadLibraryExA FindNextVolumeW FindFirstVolumeW SetLastError UnhandledExceptionFilter GetProcAddress GetModuleHandleA Sleep CloseHandle DuplicateHandle SetUnhandledExceptionFilter

ws2_32

getsockname WSAStartup bind freeaddrinfo getaddrinfo send recv setsockopt getsockopt WSAGetLastError WSAIoctl connect ioctlsocket WSASocketW closesocket WSACleanup

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtWriteFile NtOpenFile RtlGetVersion NtCreateNamedPipeFile NtQuerySystemInformation NtQueryInformationProcess

advapi32

CopySid GetLengthSid IsValidSid GetTokenInformation OpenProcessToken

oleaut32

GetErrorInfo SysStringLen SysFreeString

bcryptprimitives

ProcessPrng

ole32

CoCreateInstance CoInitializeEx

pdh

PdhCloseQuery PdhRemoveCounter

user32

GetKeyboardLayout

psapi

GetProcessMemoryInfo GetModuleFileNameExW

shell32

CommandLineToArgvW

powrprof

CallNtPowerInformation

vcruntime140

__CxxFrameHandler3 memcpy memcmp memset memmove __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_set_app_type _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _register_onexit_function _initterm _seh_filter_exe exit _exit __p___argc _get_initial_narrow_environment terminate _crt_atexit __p___argv _cexit _c_exit _initterm_e _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode