ab9d30b34b79ea84c01cd9ba6df9957212e40a7014e7b6c4c68df883d30c86d7_unsafe[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ab9d30b34b79ea84c01cd9ba6df9957212e40a7014e7b6c4c68df883d30c86d7_unsafe.exe
Size 83KB
Sample260930-phl2davtfv
SHA256 ab9d30b34b79ea84c01cd9ba6df9957212e40a7014e7b6c4c68df883d30c86d7
MD5 a27327262bb9b9dbd7b165d1ef12bdd3
SHA1 4454392af54fddd2e800bac0c55db0472186d13c
SHA512 4a64af8f57182ff4d72d3dde6109ae7f9232f86a62588473e16a16eec5f7a8b9cc6576a741145667bd6fba4bc7aa9cb0a7efb3f0eca110bdf5cacc1156b2ac92
SSDEEP 1536:6iBsQfVw75jfBrL28z5/fJ+RiDsWakvj1nrp:paVjfBrLb/RkWsAxN
TLSH
T1B183E0D1B8CF58F1D49B07784E2B9D0FB634A8512679CFBBE784550A988321A3F2E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab9d30b34b79ea84c01cd9ba6df9957212e40a7014e7b6c4c68df883d30c86d7_unsafe.exe

File Explorer

ab9d30b34b79ea84c01cd9ba6df9957212e40a7014e7b6c4c68df883d30c86d7_unsafe.exe

.exe 83KB

ab9d30b34b79ea84c01cd9ba6df9957212e40a7014e7b6c4c68df883d30c86d7_unsafe.exe

IMPHASH cb55ef8ddff6ca096823fd960459bc3a
SHA256 ab9d30b34b79ea84c01cd9ba6df9957212e40a7014e7b6c4c68df883d30c86d7
MD5 a27327262bb9b9dbd7b165d1ef12bdd3
SHA1 4454392af54fddd2e800bac0c55db0472186d13c
SHA512 4a64af8f57182ff4d72d3dde6109ae7f9232f86a62588473e16a16eec5f7a8b9cc6576a741145667bd6fba4bc7aa9cb0a7efb3f0eca110bdf5cacc1156b2ac92
SSDEEP 1536:6iBsQfVw75jfBrL28z5/fJ+RiDsWakvj1nrp:paVjfBrLb/RkWsAxN
TLSH
T1B183E0D1B8CF58F1D49B07784E2B9D0FB634A8512679CFBBE784550A988321A3F2E315
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileW FindFirstFileW FindClose FindNextFileW GetWindowsDirectoryW WaitForSingleObject GetModuleHandleW GetTickCount Sleep CreateProcessA GetModuleFileNameW GetStartupInfoA ReadFile GetFileSize DeleteFileA CreateThread GetProcAddress LoadLibraryA GetCurrentProcess GetLastError GetSystemInfo GetModuleHandleA GlobalAlloc GlobalFree GetTempFileNameA CreateFileA CloseHandle GetVersionExA CreateToolhelp32Snapshot GetDiskFreeSpaceA HeapReAlloc Process32Next GetCurrentDirectoryW GetSystemDirectoryA GetFileAttributesW GetVolumeInformationA OpenProcess GetDriveTypeA GetLogicalDrives Process32First GetDriveTypeW GetComputerNameA GetProcessHeap HeapFree HeapAlloc GetTempPathA GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

GetWindowRect GetWindowDC ReleaseDC GetDesktopWindow

gdi32

CreateDIBSection CreateCompatibleDC DeleteObject DeleteDC BitBlt SelectObject

advapi32

GetTokenInformation OpenProcessToken GetUserNameA CreateWellKnownSid CheckTokenMembership DuplicateToken

shell32

SHGetFolderPathW ord680

ole32

CreateStreamOnHGlobal

ntdll

_snwprintf _wcsicmp sprintf memcpy memset

wininet

InternetReadFile InternetSetOptionA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle HttpQueryInfoA InternetConnectA

iphlpapi

GetAdaptersInfo

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdiplusStartup

psapi

GetModuleFileNameExA

mpr

WNetCloseEnum WNetOpenEnumW WNetEnumResourceW

Name

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

332B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ab9d30b34b79ea84c01cd9ba6df9957212e40a7014e7b6c4c68df883d30c86d7_unsafe.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

ntdll

wininet

iphlpapi

gdiplus

psapi

mpr

generic