2f8b6743a72bc342f8fea9b2e04937357879c43142c4a641fa70bccb358b401d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2f8b6743a72bc342f8fea9b2e04937357879c43142c4a641fa70bccb358b401d.exe
Size 13.1MB
Sample261002-gzedvs1ejh
SHA256 2f8b6743a72bc342f8fea9b2e04937357879c43142c4a641fa70bccb358b401d
MD5 2b4aa3d6dcba32ca7ee4ff364d4bc927
SHA1 134df2b1f1892578011bf471322ba4a36fac5b44
SHA512 42c63a01f8e170a318f2475759f1bd7ce9752a3242c53858445be2b2c7c606d07fdd381835e2ceae654a46b84e0b57e84d7cdfaabe7a35094366f99b217d858f
SSDEEP 98304:9XUDF8FOgK8vDp8tsV0cNjqlIZ1/6hmiXHGLahcedHl4vIvFsGRz6nr+v63qwm:SF8FOgK8vDp8to0cIhhmchudk/
TLSH
T10DD6F8257B5A99ACD09BC47483468A62497130CB0F39B9FF449496383F7ABF52F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f8b6743a72bc342f8fea9b2e04937357879c43142c4a641fa70bccb358b401d.exe

File Explorer

2f8b6743a72bc342f8fea9b2e04937357879c43142c4a641fa70bccb358b401d.exe

.exe 13.1MB

2f8b6743a72bc342f8fea9b2e04937357879c43142c4a641fa70bccb358b401d.exe

IMPHASH 8c67064a4470c606edb4c9f87597ce81
SHA256 2f8b6743a72bc342f8fea9b2e04937357879c43142c4a641fa70bccb358b401d
MD5 2b4aa3d6dcba32ca7ee4ff364d4bc927
SHA1 134df2b1f1892578011bf471322ba4a36fac5b44
SHA512 42c63a01f8e170a318f2475759f1bd7ce9752a3242c53858445be2b2c7c606d07fdd381835e2ceae654a46b84e0b57e84d7cdfaabe7a35094366f99b217d858f
SSDEEP 98304:9XUDF8FOgK8vDp8tsV0cNjqlIZ1/6hmiXHGLahcedHl4vIvFsGRz6nr+v63qwm:SF8FOgK8vDp8to0cIhhmchudk/
TLSH
T10DD6F8257B5A99ACD09BC47483468A62497130CB0F39B9FF449496383F7ABF52F38358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9612856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

forceeasy_ai_assistant.pdb

bcryptprimitives

ProcessPrng

advapi32

RegGetValueW RegOpenKeyExW RegCloseKey RegQueryValueExW EventSetInformation CredDeleteW SystemFunction036 CredWriteW EventRegister CredFree CredReadW EventUnregister EventWriteTransfer

ntdll

NtCreateNamedPipeFile NtOpenFile NtCreateFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile RtlGetVersion NtWriteFile NtReadFile

kernel32

IsThreadAFiber FlsSetValue GetModuleHandleExW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA SwitchToThread ExitProcess AcquireSRWLockExclusive FindFirstFileExW GetModuleHandleW GetUserDefaultUILanguage GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CreateDirectoryW GetExitCodeProcess GetEnvironmentStringsW TerminateProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx SetFileTime GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext WriteFileEx SleepEx ReadFileEx CreateThread QueryPerformanceFrequency DuplicateHandle SetHandleInformation GetCurrentProcess GetStdHandle SetFileInformationByHandle SetLastError FreeEnvironmentStringsW CompareStringOrdinal DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateIoCompletionPort LCIDToLocaleName PostQueuedCompletionStatus GetQueuedCompletionStatusEx ReadFile GetOverlappedResult WriteFile CancelIoEx RaiseException GetCurrentThreadId GetFileAttributesW GetModuleFileNameW GetLastError LoadLibraryExW FreeLibrary GetFileInformationByHandle GetConsoleMode AreFileApisANSI CreateFileW FindNextFileW WakeAllConditionVariable HeapCreate GetFullPathNameW GetDiskFreeSpaceW LockFile SetNamedPipeHandleState SetFilePointer GetFullPathNameA SetEndOfFile SleepConditionVariableSRW IsProcessorFeaturePresent UnlockFileEx GetTempPathW CreateMutexW SetFileAttributesW MoveFileExW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree TlsAlloc TlsGetValue TlsSetValue WaitForSingleObject UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA GetDiskFreeSpaceA InitializeCriticalSectionAndSpinCount TlsFree lstrlenW ReleaseSRWLockExclusive GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc GetSystemInfo IsDebuggerPresent HeapCompact HeapDestroy UnlockFile LoadLibraryExA LocalFree HeapAlloc LockFileEx GetFileSize GetCurrentProcessId FormatMessageW LoadLibraryA SystemTimeToFileTime WideCharToMultiByte RtlPcToFileHeader LoadLibraryW EncodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead RtlUnwindEx GetModuleHandleA Sleep GetProcAddress CloseHandle SetFileCompletionNotificationModes FindClose RtlVirtualUnwind GetEnvironmentVariableW FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime

user32

PostThreadMessageW PeekMessageW GetUpdateRect TranslateMessage DispatchMessageW DestroyWindow PostMessageW LoadCursorW ScreenToClient GetWindowLongW GetClientRect ClientToScreen GetCursorPos MonitorFromWindow MonitorFromRect GetMonitorInfoW VkKeyScanW DestroyMenu TrackPopupMenu PostQuitMessage RemoveMenu AppendMenuW InsertMenuW DrawIconEx CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable CreatePopupMenu CreateMenu GetSystemMetrics FillRect DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DrawMenuBar SetMenu GetMenuItemInfoW CreateIcon ToUnicodeEx GetKeyboardLayout SystemParametersInfoW MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState GetRawInputData IsIconic SetPropW SendInput TrackMouseEvent SetWindowTextW GetWindowTextW GetWindowTextLengthW SetCursor GetTouchInputInfo ValidateRect SetWindowDisplayAffinity SetWindowPos SetWindowLongW EnableMenuItem GetSystemMenu InvalidateRgn SetCursorPos DestroyIcon EnumDisplayMonitors MonitorFromPoint GetMenu ShowCursor ClipCursor GetClipCursor SetForegroundWindow ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx SendMessageW RegisterRawInputDevices RegisterWindowMessageA GetWindow SetParent MapWindowPoints RedrawWindow AdjustWindowRect SetFocus ShowWindow ReleaseDC EnableWindow IsWindowEnabled CloseTouchInputHandle IsProcessDPIAware GetDC GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn RegisterTouchWindow InvalidateRect EnumChildWindows DispatchMessageA GetMessageA RegisterClassExW SystemParametersInfoA GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW IsWindowVisible DefWindowProcW MapVirtualKeyW FlashWindowEx GetMessageW IsWindow CreateWindowExW AdjustWindowRectEx TranslateAcceleratorW GetForegroundWindow GetActiveWindow UpdateWindow

comctl32

TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass DefSubclassProc

gdi32

GetDeviceCaps DeleteDC CombineRgn SelectObject CreateDIBSection SetTextColor BitBlt CreateCompatibleDC CreateRectRgn SetBkMode DeleteObject CreateSolidBrush

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ole32

CoCreateFreeThreadedMarshaler OleInitialize RegisterDragDrop CoUninitialize CoInitializeEx RevokeDragDrop CoCreateInstance

shlwapi

SHCreateMemStream

ws2_32

WSACleanup WSAStartup freeaddrinfo setsockopt WSAGetLastError closesocket getpeername getsockname getsockopt WSAIoctl WSASend ioctlsocket connect recv send bind WSASocketW getaddrinfo shutdown

shell32

SHGetKnownFolderPath ShellExecuteW DragQueryFileW DragFinish SHAppBarMessage

combase

CoTaskMemFree CoTaskMemAlloc

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

oleaut32

SysFreeString SysStringLen SetErrorInfo GetErrorInfo

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

log round pow fmod __setusermatherr roundf floor trunc

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen strspn wcsncmp strcspn strcpy_s strlen strncmp wcscmp strcmp

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-heap-l1-1-0

calloc _msize realloc _set_new_mode malloc free _callnewh

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _register_onexit_function abort _get_initial_narrow_environment _initialize_onexit_table _initterm _initialize_narrow_environment _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit _set_app_type _endthreadex exit _beginthreadex _initterm_e _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale