selamgenco[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
selamgenco.exe
Size 643KB
Sample261002-zfb4hasbrf
SHA256 e5c0959fadcbbe02e7bc4db3e40291237ace6cb02f1be0248bfe88d9cfdeed38
MD5 c22e7bda7115fb8e7ac9da59ffe46501
SHA1 76ae034423f40df22eb832da47e2e56829d82a39
SHA512 5f13b4a50cfb911e4d35c9e9acacc7196dcba94e556c382ce73df65e4c001352671594b28466e29020496a90017955df6bbf47133ea2f2ce4c4cd61e4dce7dc7
SSDEEP 12288:WTyux52ZfYJCXMag1GLHStnwa8u8bjTbpchYDGXL/Mw7sjoqruVAIe9/:WJriiCq1GLaT8uGlt2rMKE3YVeF
TLSH
T19BE4AE8FF2A2A9B8D11BC478D35A5673FE22788905223D7B17F49B303D46B906B18F45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
selamgenco.exe

File Explorer

selamgenco.exe

.exe 643KB

selamgenco.exe

IMPHASH cfc28c9d69c254b84dd4892a160b6429
SHA256 e5c0959fadcbbe02e7bc4db3e40291237ace6cb02f1be0248bfe88d9cfdeed38
MD5 c22e7bda7115fb8e7ac9da59ffe46501
SHA1 76ae034423f40df22eb832da47e2e56829d82a39
SHA512 5f13b4a50cfb911e4d35c9e9acacc7196dcba94e556c382ce73df65e4c001352671594b28466e29020496a90017955df6bbf47133ea2f2ce4c4cd61e4dce7dc7
SSDEEP 12288:WTyux52ZfYJCXMag1GLHStnwa8u8bjTbpchYDGXL/Mw7sjoqruVAIe9/:WJriiCq1GLaT8uGlt2rMKE3YVeF
TLSH
T19BE4AE8FF2A2A9B8D11BC478D35A5673FE22788905223D7B17F49B303D46B906B18F45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegOpenKeyExA

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileA CreateFileMappingA CreateFileW CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileExW FlsAlloc FlsFree FlsSetValue FlushInstructionCache FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetThreadContext HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsThreadAFiber LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAlloc VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW __C_specific_handler

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

347KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

804B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

selamgenco.exe

advapi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-synch-l1-2-0

generic