ed1acda2c364b138f3e0292648f2fc8b9f71361640cb6c7b73ce2ab2797ff71f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ed1acda2c364b138f3e0292648f2fc8b9f71361640cb6c7b73ce2ab2797ff71f.exe
Size 5.9MB
Sample261007-sh1rbazzet
SHA256 ed1acda2c364b138f3e0292648f2fc8b9f71361640cb6c7b73ce2ab2797ff71f
MD5 4f13935510d8d9f4a9d59ad161439abc
SHA1 9424cc96b779d5e23803aeb95dbe5c159fd20bed
SHA512 62d42cfd522213784a0a87ddd78163d775e4703ce45b04c0ea164e0fd109fa20cd436ab7b2a5274516cce83ea2d32cbc39ee31632c0d72c80d1f71fdf8fcf162
SSDEEP 98304:v8RT7036iHJrjcoplqFEnRwbsyN6AVwkV:OiprPqFYE
TLSH
T104564B83A5DB0CE9CED6A77861C76336A734FD7189291F2BAB44D6311D636C06E1EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed1acda2c364b138f3e0292648f2fc8b9f71361640cb6c7b73ce2ab2797ff71f.exe

File Explorer

ed1acda2c364b138f3e0292648f2fc8b9f71361640cb6c7b73ce2ab2797ff71f.exe

.exe 5.9MB

ed1acda2c364b138f3e0292648f2fc8b9f71361640cb6c7b73ce2ab2797ff71f.exe

IMPHASH 1e71189c026afbb57c22c928efaf109c
SHA256 ed1acda2c364b138f3e0292648f2fc8b9f71361640cb6c7b73ce2ab2797ff71f
MD5 4f13935510d8d9f4a9d59ad161439abc
SHA1 9424cc96b779d5e23803aeb95dbe5c159fd20bed
SHA512 62d42cfd522213784a0a87ddd78163d775e4703ce45b04c0ea164e0fd109fa20cd436ab7b2a5274516cce83ea2d32cbc39ee31632c0d72c80d1f71fdf8fcf162
SSDEEP 98304:v8RT7036iHJrjcoplqFEnRwbsyN6AVwkV:OiprPqFYE
TLSH
T104564B83A5DB0CE9CED6A77861C76336A734FD7189291F2BAB44D6311D636C06E1EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CloseServiceHandle ControlService CreateProcessAsUserA DuplicateTokenEx EnumServicesStatusA GetTokenInformation LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA PrivilegeCheck QueryServiceStatus RevertToSelf SetThreadToken SetTokenInformation

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmGetColorizationColor DwmIsCompositionEnabled DwmSetWindowAttribute

gdi32

BitBlt CreateRectRgn DeleteObject GetDeviceCaps StretchBlt

kernel32

AddVectoredExceptionHandler Beep CheckRemoteDebuggerPresent CloseHandle CreateEventA CreateRemoteThread CreateRemoteThreadEx CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FormatMessageA FreeLibrary GetCommandLineA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetLocaleInfoA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessId GetProcessTimes GetStartupInfoA GetSystemTimeAdjustment GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapSetInformation InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LocalFree Module32First Module32Next MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess Thread32First Thread32Next TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualAllocEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteProcessMemory

api-ms-win-crt-convert-l1-1-0

atof mbrtowc mbsrtowcs strtol strtoll strtoul strtoull wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen _hypot acosf atan2f ceilf cosf fmodf log logf pow powf sinf sqrtf

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_errno _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s _fileno _fileno _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _read _setmode _wfopen _write fclose fflush fopen fputc fputs fread fseek ftell fwrite getc getwc putc putwc setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_strdup _stricmp isdigit isspace iswctype isxdigit mbrlen memset strcmp strcoll strcpy_s strlen strncmp strncpy strnlen strxfrm tolower toupper towlower towupper wcscoll wcscpy_s wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

qsort rand rand_s

ntdll

VerSetConditionMask ZwReadVirtualMemory ZwWriteVirtualMemory

ole32

CoCreateInstance CoInitializeEx

user32

BringWindowToTop ClientToScreen CloseClipboard CreateWindowExW DefWindowProcA DestroyWindow DispatchMessageA EmptyClipboard EnumWindows FindWindowA FindWindowW GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindowLongA GetWindowLongPtrA GetWindowRect GetWindowTextA GetWindowTextLengthA GetWindowThreadProcessId IsClipboardFormatAvailable IsWindowUnicode IsWindowVisible LoadCursorA MessageBoxA MonitorFromWindow MoveWindow OpenClipboard PeekMessageA PostQuitMessage PrintWindow RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetLayeredWindowAttributes SetProcessDPIAware SetWindowDisplayAffinity SetWindowLongA SetWindowLongPtrA SetWindowPos SetWindowsHookA ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW UpdateWindow WindowFromDC mouse_event

ws2_32

WSASetLastError

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

751KB

Virtual Size

750KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

588KB

Virtual Size

587KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

981B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ed1acda2c364b138f3e0292648f2fc8b9f71361640cb6c7b73ce2ab2797ff71f.exe

advapi32

d3d11

d3dcompiler_47

dwmapi

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ntdll

ole32

user32

ws2_32

generic