b620dd86f5854c7f4f9d6a220f186db44d536380322241f0933717090c3f1fe2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
b620dd86f5854c7f4f9d6a220f186db44d536380322241f0933717090c3f1fe2.exe
Size 1.2MB
Sample260930-lt13wsvtbs
SHA256 b620dd86f5854c7f4f9d6a220f186db44d536380322241f0933717090c3f1fe2
MD5 1c748d61657d343aafc00ea56d6a6317
SHA1 6b3c2cf17f756ab7ace557a93aa93824c8ca80f9
SHA512 9e7d27569dbfbceb947475d184eadb40948fbed0e7981c7d0e21af4a30a9f51b2c68a327ad67890ddba6051d7094a4c7bcc657702f4a52a4454cc934a9cb091b
SSDEEP 24576:vi2zugzecDkAgIw5XQhqoMd5WT1EKWZQci:62zFzhBEA65WT1B
TLSH
T119453C57E36344FCC5ABC17886679B72B970B8594234BD7E1A98D7322F20E50972EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b620dd86f5854c7f4f9d6a220f186db44d536380322241f0933717090c3f1fe2.exe

File Explorer

b620dd86f5854c7f4f9d6a220f186db44d536380322241f0933717090c3f1fe2.exe

.dll 1.2MB

b620dd86f5854c7f4f9d6a220f186db44d536380322241f0933717090c3f1fe2.exe

IMPHASH 92dca180a78156722eb8509762f212bc
SHA256 b620dd86f5854c7f4f9d6a220f186db44d536380322241f0933717090c3f1fe2
MD5 1c748d61657d343aafc00ea56d6a6317
SHA1 6b3c2cf17f756ab7ace557a93aa93824c8ca80f9
SHA512 9e7d27569dbfbceb947475d184eadb40948fbed0e7981c7d0e21af4a30a9f51b2c68a327ad67890ddba6051d7094a4c7bcc657702f4a52a4454cc934a9cb091b
SSDEEP 24576:vi2zugzecDkAgIw5XQhqoMd5WT1EKWZQci:62zFzhBEA65WT1B
TLSH
T119453C57E36344FCC5ABC17886679B72B970B8594234BD7E1A98D7322F20E50972EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty

kernel32

CloseHandle CreateDirectoryA CreateEventA CreateFileW CreateHardLinkW CreateMutexA CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection FormatMessageA FreeLibrary GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetFileAttributesW GetFileInformationByHandle GetFullPathNameW GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryA LocalFree MoveFileExW OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

_wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64 _fstat64

api-ms-win-crt-heap-l1-1-0

calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func localeconv setlocale

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-private-l1-1-0

longjmp memchr memcmp memcpy memmove strchr __intrinsic_setjmp

api-ms-win-crt-runtime-l1-1-0

_assert _beginthreadex _endthreadex _errno _execute_onexit_table _exit _get_errno _initialize_onexit_table _initterm _initterm_e _register_onexit_function _set_errno abort strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf _chsize_s _close _get_osfhandle _pclose _setmode _wfopen _wopen fclose fflush fgets fputc fputs fwrite setvbuf fopen _write _read _popen _lseeki64 _fileno

api-ms-win-crt-string-l1-1-0

iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm tolower towlower towupper wcscat wcscmp wcscoll wcscpy wcslen wcsnlen wcsxfrm wctype _strdup

api-ms-win-crt-time-l1-1-0

_wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand rand_s srand

shell32

SHGetFolderPathA

ws2_32

WSAStartup closesocket connect htonl htons inet_pton ntohl recv select send setsockopt socket

_GCC_specific_handler _Unwind_Backtrace _Unwind_DeleteException _Unwind_FindEnclosingFunction _Unwind_ForcedUnwind _Unwind_GetCFA _Unwind_GetDataRelBase _Unwind_GetGR _Unwind_GetIP _Unwind_GetIPInfo _Unwind_GetLanguageSpecificData _Unwind_GetRegionStart _Unwind_GetTextRelBase _Unwind_RaiseException _Unwind_Resume _Unwind_Resume_or_Rethrow _Unwind_SetGR _Unwind_SetIP _ZNKSt23__codecvt_abstract_baseIwc9_MbstatetE2inERS0_PKcS4_RS4_PwS6_RS6_ _ZNKSt23__codecvt_abstract_baseIwc9_MbstatetE3outERS0_PKwS4_RS4_PcS6_RS6_ _ZNKSt5ctypeIcE8do_widenEc _ZNSt10filesystem7__cxx114path10_S_convertIcEEDaPKT_S5_ _ZNSt10filesystem7__cxx114path8_CodecvtIwED0Ev _ZNSt10filesystem7__cxx114path8_CodecvtIwED1Ev _ZNSt10filesystem7__cxx118__detail24__throw_conversion_errorEv _ZNSt10unique_ptrINSt10filesystem7__cxx114path5_List5_ImplENS3_13_Impl_deleterEED1Ev _ZNSt15_Sp_counted_ptrIDnLN9__gnu_cxx12_Lock_policyE2EE10_M_disposeEv _ZNSt16_Sp_counted_baseILN9__gnu_cxx12_Lock_policyE2EE10_M_destroyEv _ZNSt16_Sp_counted_baseILN9__gnu_cxx12_Lock_policyE2EE10_M_releaseEv _ZNSt16_Sp_counted_baseILN9__gnu_cxx12_Lock_policyE2EE24_M_release_last_use_coldEv _ZNSt18codecvt_utf8_utf16IwLm1114111ELSt12codecvt_mode0EED0Ev _ZNSt18codecvt_utf8_utf16IwLm1114111ELSt12codecvt_mode0EED1Ev _ZNSt6vectorIhSaIhEE17_M_default_appendEy _ZNSt6vectorIhSaIhEE7reserveEy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructILb1EEEvPKcy _ZNSt7__cxx119to_stringEy _ZSteqIcSt11char_traitsIcESaIcEEbRKNSt7__cxx1112basic_stringIT_T0_T1_EEPKS5_ _ZStplIcSt11char_traitsIcESaIcEENSt7__cxx1112basic_stringIT_T0_T1_EEOS8_S9_ _ZStplIcSt11char_traitsIcESaIcEENSt7__cxx1112basic_stringIT_T0_T1_EEPKS5_OS8_ _ZTINSt10filesystem7__cxx1116filesystem_errorE _ZTINSt10filesystem7__cxx114path8_CodecvtIwEE _ZTINSt6locale5facetE _ZTISt12codecvt_base _ZTISt12system_error _ZTISt13runtime_error _ZTISt18codecvt_utf8_utf16IwLm1114111ELSt12codecvt_mode0EE _ZTISt23__codecvt_abstract_baseIwc9_MbstatetE _ZTISt25__codecvt_utf8_utf16_baseIwE _ZTISt7codecvtIwc9_MbstatetE _ZTISt9exception _ZTSNSt10filesystem7__cxx1116filesystem_errorE _ZTSNSt10filesystem7__cxx114path8_CodecvtIwEE _ZTSNSt6locale5facetE _ZTSSt12codecvt_base _ZTSSt12system_error _ZTSSt13runtime_error _ZTSSt18codecvt_utf8_utf16IwLm1114111ELSt12codecvt_mode0EE _ZTSSt23__codecvt_abstract_baseIwc9_MbstatetE _ZTSSt25__codecvt_utf8_utf16_baseIwE _ZTSSt7codecvtIwc9_MbstatetE _ZTSSt9exception _ZTVNSt10filesystem7__cxx114path8_CodecvtIwEE _ZTVSt18codecvt_utf8_utf16IwLm1114111ELSt12codecvt_mode0EE __emutls_get_address __emutls_register_common

Name

.text

Size

1008KB

Virtual Size

1008KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b620dd86f5854c7f4f9d6a220f186db44d536380322241f0933717090c3f1fe2.exe

bcrypt

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

shell32

ws2_32

generic