Mail-Pass_Searcher[.]exe

General

Target
Mail-Pass_Searcher.exe
Size 26.6MB
Sample261008-t929wsbs8v
SHA256 d18b6f33017d491381f4eb727d872955002ebbcd6c751586a088c43cb1443533
MD5 01b9c1e608e47f31030843d49eae5f7d
SHA1 54bd93728125cac6e3779b478f0f8edecddbeb9f
SHA512 9b1a1783467dd32ccdc71bc07b291105d18f5299d189a636bfca3c81bc22ee61d25e6b48d4db51fec28147b56a9e698306a6565b920e78c1c8d4c7e91c9fc504
SSDEEP 786432:D+XCp4cQLuoIr9jZvb1GSdQk+GUHXIZsuf/7REf+5yE:SXy4cOeFvbwv34/7RKr
TLSH
T1B6573324E79188D7FA3752B196C182F8F29C92287DA71A6F920E15DF2BB4D04C83D717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Mail-Pass_Searcher.exe

File Explorer

Mail-Pass_Searcher.exe

.exe 26.6MB

Mail-Pass_Searcher.exe

IMPHASH 3e3c7cd3783c316bb26868db037273eb
SHA256 d18b6f33017d491381f4eb727d872955002ebbcd6c751586a088c43cb1443533
MD5 01b9c1e608e47f31030843d49eae5f7d
SHA1 54bd93728125cac6e3779b478f0f8edecddbeb9f
SHA512 9b1a1783467dd32ccdc71bc07b291105d18f5299d189a636bfca3c81bc22ee61d25e6b48d4db51fec28147b56a9e698306a6565b920e78c1c8d4c7e91c9fc504
SSDEEP 786432:D+XCp4cQLuoIr9jZvb1GSdQk+GUHXIZsuf/7REf+5yE:SXy4cOeFvbwv34/7RKr
TLSH
T1B6573324E79188D7FA3752B196C182F8F29C92287DA71A6F920E15DF2BB4D04C83D717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExW

kernel32

FreeLibrary WriteConsoleW GetCurrentDirectoryW CreateFileW DeleteFileW FlushFileBuffers GetFileAttributesW SetFileAttributesW WriteFile GetTempPathW CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcessId CreateProcessW GetTickCount CopyFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW RaiseException GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW HeapSize HeapReAlloc GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26.5MB

Virtual Size

26.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Mail-Pass_Searcher.exe

shell32

kernel32

generic