s48hflg3de89f2g10hj[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
s48hflg3de89f2g10hj.exe
Size 63.8MB
Sample260925-p3jfzsec48
SHA256 3aa613fbc2c907bc276169601b9bcbd1593c2a64644c70bfbb0db9221631de83
MD5 0a922b9df77701bbaf242ac78004673e
SHA1 60dfae535252ac29c7fa0757e4abd03499fecf08
SHA512 977623943943af7241e760c25ef11a89935a492720f014d6763a072b79973ed56cf562c5b3eba063e1369dca06c194341de5b44ab15356ba875828276d100a68
SSDEEP 786432:VAiDv+gF24HFZunjA1WHWmsZv9IvWF5uzflMAh1j:iiDvf24lZunjA1eWmsZFI
TLSH
T165E7414C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
s48hflg3de89f2g10hj.exe

File Explorer

s48hflg3de89f2g10hj.exe

.exe 63.8MB

s48hflg3de89f2g10hj.exe

IMPHASH 4f4400167676f3973c9d4e52f2103c90
SHA256 3aa613fbc2c907bc276169601b9bcbd1593c2a64644c70bfbb0db9221631de83
MD5 0a922b9df77701bbaf242ac78004673e
SHA1 60dfae535252ac29c7fa0757e4abd03499fecf08
SHA512 977623943943af7241e760c25ef11a89935a492720f014d6763a072b79973ed56cf562c5b3eba063e1369dca06c194341de5b44ab15356ba875828276d100a68
SSDEEP 786432:VAiDv+gF24HFZunjA1WHWmsZv9IvWF5uzflMAh1j:iiDvf24lZunjA1eWmsZFI
TLSH
T165E7414C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55744208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExitProcess CreateProcessW FreeLibrary GetConsoleWindow QueryFullProcessImageNameW CreateProcessA CreateDirectoryA IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent GetModuleHandleW MultiByteToWideChar WideCharToMultiByte LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter TerminateProcess GetCurrentThread Module32FirstW GetCurrentProcessId Module32NextW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadConsoleW GetFileAttributesExW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFileAttributesW GetFileSizeEx UnhandledExceptionFilter IsProcessorFeaturePresent GetCommandLineW GetTempPathA GetProcAddress FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError UnmapViewOfFile MapViewOfFile SetFileAttributesA GetWindowsDirectoryA CreateThread LoadLibraryW CloseHandle Process32FirstW DeleteFileW DeleteFileA CreateFileA OpenProcess GetModuleHandleA GetFileAttributesW WaitForSingleObject FindClose GetEnvironmentVariableA FindNextFileA GetModuleFileNameW WriteFile Sleep CreateFileMappingA GetFileSize VirtualQuery GetStdHandle GetCurrentProcess VirtualFree VirtualAlloc RemoveVectoredExceptionHandler GetThreadContext GetTickCount VirtualAllocEx ReadFile SetFilePointer GetSystemDirectoryA VirtualFreeEx IsWow64Process GetSystemInfo DuplicateHandle HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetProcessHeap RaiseException AddVectoredExceptionHandler K32GetModuleInformation GetCPInfo SetConsoleTitleA GetStringTypeW LCMapStringEx LocalFree DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx Process32NextW GetFileAttributesA GetLastError GetModuleHandleExW GetTickCount64 GetCommandLineA CreateToolhelp32Snapshot LeaveCriticalSection EnterCriticalSection GetConsoleScreenBufferInfo VirtualProtect SetFilePointerEx FindFirstFileA SetEndOfFile WriteConsoleW CreateFileW SetStdHandle OutputDebugStringW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead

user32

SetWindowLongW MessageBoxA GetSystemMetrics FindWindowW SetLayeredWindowAttributes SetWindowsHookExW GetDC PostMessageW GetWindowThreadProcessId GetWindowLongW ReleaseDC PostThreadMessageW UnregisterClassA

gdi32

DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap DeleteObject BitBlt

advapi32

ConvertSidToStringSidA GetTokenInformation IsValidSid GetLengthSid CopySid LookupAccountSidA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExA RegCreateKeyExA GetUserNameA RegSetValueExA OpenProcessToken RegOpenKeyExA OpenThreadToken

shell32

SHGetFolderPathA

ole32

CLSIDFromString

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd VMProtectBeginMutation

winhttp

WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpReceiveResponse WinHttpCloseHandle WinHttpSendRequest WinHttpReadData

wininet

InternetReadFile InternetOpenA InternetCloseHandle InternetOpenUrlA

gdiplus

GdipAlloc GdiplusStartup GdiplusShutdown GdipDisposeImage GdipFree GdipCloneImage GdipCreateBitmapFromHBITMAP GdipSaveImageToFile

shlwapi

ord215

userenv

UnloadUserProfile

ntdll

RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry NtClose RtlUnwind NtCreateSection NtMapViewOfSection RtlImageNtHeader NtUnmapViewOfSection

Name

.text

Size

53.3MB

Virtual Size

53.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

s48hflg3de89f2g10hj.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

vmprotectsdk64

winhttp

wininet

gdiplus

shlwapi

userenv

ntdll

generic