file_c5b0b8f9b84a1473[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
file_c5b0b8f9b84a1473.exe
Size 3.1MB
Sample260930-appnhsaf97
SHA256 27831a5b95bbc1fab82732019109d94feefcb31fa4c4815eeb7500ba702c174d
MD5 cfa1c609d1596ca066c6c6e9fce1ad44
SHA1 9bbc180af0625e0483058b2daa77b8318a1573bd
SHA512 2318535e38b1579dfe6387a12723857c021ddcb6f4fc6ad69b878800a8ef89958fa2e75477f35adf062b51b3d77dc5e866e77ef85802162a5bffb092d86a538b
SSDEEP 49152:bd/bvgw+Wz5wIs4gGiHZKlMfIDgzVvqW3rB5c74nrrmUNPEUj8RXljlDvqrZ3g3d:baO5y6ZlDkNg
TLSH
T194E59E0AA7A500EDE027C17CCA578617FBB2F40513359AFB1A958D562F23BF1673A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file_c5b0b8f9b84a1473.exe

File Explorer

file_c5b0b8f9b84a1473.exe

.exe 3.1MB

file_c5b0b8f9b84a1473.exe

IMPHASH ef1e7cc915fc7c39116df28b9a95c3f7
SHA256 27831a5b95bbc1fab82732019109d94feefcb31fa4c4815eeb7500ba702c174d
MD5 cfa1c609d1596ca066c6c6e9fce1ad44
SHA1 9bbc180af0625e0483058b2daa77b8318a1573bd
SHA512 2318535e38b1579dfe6387a12723857c021ddcb6f4fc6ad69b878800a8ef89958fa2e75477f35adf062b51b3d77dc5e866e77ef85802162a5bffb092d86a538b
SSDEEP 49152:bd/bvgw+Wz5wIs4gGiHZKlMfIDgzVvqW3rB5c74nrrmUNPEUj8RXljlDvqrZ3g3d:baO5y6ZlDkNg
TLSH
T194E59E0AA7A500EDE027C17CCA578617FBB2F40513359AFB1A958D562F23BF1673A321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1630832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError GetFileAttributesA Process32NextW MoveFileExA CreateFileA GetSystemDirectoryA SetDllDirectoryA LoadLibraryA DeleteFileA GlobalAlloc Process32FirstW GlobalFree CloseHandle CreateThread GetWindowsDirectoryA HeapAlloc GetLocalTime GetLogicalDriveStringsA VirtualProtectEx GetProcAddress GlobalLock SetFilePointerEx VirtualAllocEx LocalFree GetFileSize RemoveDirectoryA ExitProcess ReadProcessMemory GetCurrentProcessId GetProcessHeap CreateProcessW FreeLibrary WideCharToMultiByte CreateRemoteThread QueryFullProcessImageNameW CreateProcessA GetFileType GetDiskFreeSpaceExA CreateDirectoryA GetTempFileNameA GetTickCount GlobalUnlock ConnectNamedPipe VirtualQueryEx GetComputerNameA GetExitCodeProcess FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate UnmapViewOfFile CreateFileW UnlockFileEx SetEndOfFile SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetTickCount64 HeapCreate AreFileApisANSI RaiseException WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage SetStdHandle GetCurrentDirectoryW ReadConsoleW GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetTempPathA GetFinalPathNameByHandleA Sleep MultiByteToWideChar ReadFile CreateEventW CreateToolhelp32Snapshot OpenProcess GetModuleHandleA DuplicateHandle CopyFileA GetSystemDirectoryW ReleaseMutex lstrcmpA GetCurrentThreadId GetFileAttributesW WaitForSingleObject GetVolumeInformationA FindClose GetEnvironmentVariableA CreateMutexW GetTempPathW PeekNamedPipe GetFullPathNameA ExpandEnvironmentStringsA CreatePipe FindNextFileA CreateNamedPipeW GetDriveTypeA TerminateProcess WriteFile GetCurrentProcess HeapFree FindFirstFileA SetHandleInformation WriteProcessMemory InitializeSListHead GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer GetFileSizeEx CancelIo GetModuleFileNameA GetFullPathNameW EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

PostThreadMessageW PrintWindow CreateDesktopA wsprintfW SetClipboardData SendMessageA EnumDesktopWindows TranslateMessage OpenInputDesktop SetFocus UnhookWindowsHookEx GetForegroundWindow ToUnicodeEx MapVirtualKeyA GetKeyboardLayout DrawIconEx GetWindowTextA PeekMessageW SetWindowsHookExA EmptyClipboard CloseClipboard GetCursorInfo DispatchMessageW OpenClipboard CloseDesktop GetAsyncKeyState IsWindow wsprintfA GetKeyboardState MenuItemFromPoint SetForegroundWindow GetAncestor SetCursorPos ReleaseDC GetThreadDesktop SetThreadDesktop GetWindowPlacement WindowFromPoint ChildWindowFromPointEx GetClassNameA GetSystemMetrics RealGetWindowClassA SendInput GetWindowLongA CallNextHookEx GetWindowThreadProcessId GetKeyState MapVirtualKeyW EnumDisplayDevicesA GetLastInputInfo GetWindowRect GetDC IsWindowVisible PostMessageA FillRect ScreenToClient

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt DeleteDC SetStretchBltMode DeleteObject CreateSolidBrush GetDeviceCaps

advapi32

RegCreateKeyExA RegEnumKeyExA RegQueryValueExW DuplicateTokenEx RegEnumValueA AdjustTokenPrivileges CryptAcquireContextA RevertToSelf RegCloseKey RegDeleteKeyA RegQueryValueExA CryptGenRandom AllocateAndInitializeSid LookupPrivilegeValueA CryptReleaseContext GetUserNameA ImpersonateLoggedOnUser RegSetValueExA OpenProcessToken FreeSid RegQueryInfoKeyA CheckTokenMembership RegOpenKeyExA RegOpenKeyExW

shell32

SHGetFolderPathA SHGetFolderPathW

ole32

CreateStreamOnHGlobal CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance CoCreateGuid

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptGenerateSymmetricKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDestroyKey

ncrypt

NCryptFreeBuffer NCryptOpenStorageProvider NCryptEnumKeys NCryptDecrypt NCryptFreeObject NCryptOpenKey

gdiplus

GdiplusShutdown GdipGetImageEncoders GdipAlloc GdiplusStartup GdipCloneImage GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipCreateBitmapFromHBITMAP GdipDisposeImage

ws2_32

WSAGetLastError setsockopt ioctlsocket freeaddrinfo htons htonl recv connect socket send WSAStartup getaddrinfo ntohl select closesocket __WSAFDIsSet WSACleanup

Name

5jkwd8_

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

srobs9j

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

caodkq5

Size

20KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

w7djkpt

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

cxq31aq

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

wo7qsr4

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

jd6wbt8

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file_c5b0b8f9b84a1473.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

crypt32

bcrypt

ncrypt

gdiplus

ws2_32

generic