4J8576A0E8V3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
4J8576A0E8V3.exe
Size 2.6MB
Sample261009-pg85hsxs5m
SHA256 ea28b85e97fdfe77335e8625586212f0df64ceee15c8290d17b75e6096694d81
MD5 1f7aa3a0425d198ff16df8e903d56aac
SHA1 cc514536ad84fca256cb1e5f7255f18a6809e6d0
SHA512 0a8dd68b65a6da654e457f5d73fea1a6071c8a5d85bd984ca99a52c7a5a9e682a9e7e27b2a45255b1834229284b56c83e307cd6afc23ccf7d55a3a4f93bcc3f6
SSDEEP 49152:i795t5WNFN8llgHKWmBNzD+CnySA88RvCEOV70eM1VM6Wys:i795vWNP2lsV+f+CnW86CEOVEDjWy
TLSH
T16DC5029F31E62069F9E83330D47577B60ED2BD8A78E49E8CC694552C7E0D02D498E2F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4J8576A0E8V3.exe

File Explorer

4J8576A0E8V3.exe

.exe 2.6MB

4J8576A0E8V3.exe

IMPHASH f1d840d6eae17d90e2995a85b3633177
SHA256 ea28b85e97fdfe77335e8625586212f0df64ceee15c8290d17b75e6096694d81
MD5 1f7aa3a0425d198ff16df8e903d56aac
SHA1 cc514536ad84fca256cb1e5f7255f18a6809e6d0
SHA512 0a8dd68b65a6da654e457f5d73fea1a6071c8a5d85bd984ca99a52c7a5a9e682a9e7e27b2a45255b1834229284b56c83e307cd6afc23ccf7d55a3a4f93bcc3f6
SSDEEP 49152:i795t5WNFN8llgHKWmBNzD+CnySA88RvCEOV70eM1VM6Wys:i795vWNP2lsV+f+CnW86CEOVEDjWy
TLSH
T16DC5029F31E62069F9E83330D47577B60ED2BD8A78E49E8CC694552C7E0D02D498E2F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA

kernel32

CloseHandle CreateFileA CreateFileMappingA CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection ExitProcess FindResourceA GetCurrentThreadId GetDiskFreeSpaceExA GetEnvironmentVariableA GetExitCodeThread GetFileAttributesA GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemDirectoryA GetSystemInfo GetThreadContext GetTickCount GetTickCount64 GlobalMemoryStatusEx InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadResource LockResource MapViewOfFile Process32First Process32Next ResumeThread SetThreadContext SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnmapViewOfFile VirtualAlloc VirtualAllocEx VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WriteProcessMemory __C_specific_handler lstrcatA lstrcmpA lstrcmpiA

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _exit _fmode _initterm _ismbblead abort atexit calloc exit fprintf free malloc memcpy memmove signal strlen strncmp vfprintf

user32

GetSystemMetrics wsprintfA

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

336B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4J8576A0E8V3.exe

advapi32

kernel32

msvcrt

user32

generic