HashSolution[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
HashSolution.exe
Size 6.7MB
Sample261012-vb7bmaeb84
SHA256 27b1a1dc5bf97957cc34f311f66d08437516992ffd2e831cfc06a92807c87a56
MD5 a596d49e014c526f3201f3467c25333d
SHA1 a39daa2fc678d8c42f22b0e51b8cc3c702011fca
SHA512 319cad2a32d8c46a663970ab8aa412995b3cfc5cef4519f3d8fbc516282ebead62dbdf1bfa1880415d02bd90c1a786b6fe5e3893446b79c59f3aa88b844867d8
SSDEEP 196608:LK1o+E/VO6FUNHvzmRYWD4AW2Ra8cX/DkKA:O2lNO/1bBi4AJRaRX/
TLSH
T115661239E29411E9D9ABD038DB82990BEE72740503707AEB17E40A552F7B6F04AFF711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HashSolution.exe

File Explorer

HashSolution.exe

.exe 6.7MB

HashSolution.exe

IMPHASH fb547bc923cd9500724b51b795cde3c8
SHA256 27b1a1dc5bf97957cc34f311f66d08437516992ffd2e831cfc06a92807c87a56
MD5 a596d49e014c526f3201f3467c25333d
SHA1 a39daa2fc678d8c42f22b0e51b8cc3c702011fca
SHA512 319cad2a32d8c46a663970ab8aa412995b3cfc5cef4519f3d8fbc516282ebead62dbdf1bfa1880415d02bd90c1a786b6fe5e3893446b79c59f3aa88b844867d8
SSDEEP 196608:LK1o+E/VO6FUNHvzmRYWD4AW2Ra8cX/DkKA:O2lNO/1bBi4AJRaRX/
TLSH
T115661239E29411E9D9ABD038DB82990BEE72740503707AEB17E40A552F7B6F04AFF711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

803568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\A\Desktop\Agent Spoofer\Project\obj\HashSolution\Release\HashSolution.pdb

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

dcomp

DCompositionCreateDevice

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoInitializeEx CoCreateInstance

winhttp

WinHttpSetStatusCallback WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptGenRandom BCryptHashData BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptGetProperty BCryptImportKeyPair BCryptVerifySignature BCryptSetProperty BCryptFinishHash

wintrust

WinVerifyTrust

advapi32

QueryServiceStatusEx CheckTokenMembership FreeSid RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW ChangeServiceConfig2W LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges OpenProcessToken RegGetValueW StartServiceW AllocateAndInitializeSid OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle

kernel32

FlsSetValue FlsGetValue FlsAlloc GetStdHandle ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW GetTimeZoneInformation HeapSize HeapQueryInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentVariableW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW WriteFile CloseHandle GetLastError WaitForSingleObject Sleep TerminateProcess CreateProcessW OpenProcess GetTickCount64 GetModuleFileNameW CopyFileW WideCharToMultiByte MultiByteToWideChar GetDiskFreeSpaceExW GetVolumeInformationW GlobalMemoryStatusEx GetWindowsDirectoryW GetNativeSystemInfo GetSystemFirmwareTable GetModuleHandleW GetProcAddress GetFileSizeEx VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleHandleA GetCurrentProcess ExitProcess GetCurrentProcessId OpenThread CreateToolhelp32Snapshot GetCommandLineW Thread32Next Module32FirstW Module32NextW IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentThread GetThreadContext SetProcessMitigationPolicy SetDefaultDllDirectories Process32FirstW Process32NextW RtlCaptureContext DuplicateHandle SetLastError HeapAlloc HeapReAlloc HeapFree GetProcessHeap SleepEx SetThreadPriority SetThreadPriorityBoost GetThreadPriority SetPriorityClass GetPriorityClass GetLogicalProcessorInformationEx EnumSystemFirmwareTables VirtualLock VirtualUnlock GetSystemWow64DirectoryW FreeLibrary LoadLibraryExW GetThreadGroupAffinity SetThreadGroupAffinity GetProcessAffinityMask SetThreadAffinityMask MulDiv GetComputerNameA GetActiveProcessorGroupCount GetActiveProcessorCount LoadResource LockResource SizeofResource FindResourceW QueryPerformanceCounter QueryPerformanceFrequency GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryA GetLocaleInfoA TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetStringTypeW GetCPInfo CompareStringEx GetSystemTimeAsFileTime LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection CreateThread GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive SetStdHandle SetEndOfFile WriteConsoleW Thread32First RtlUnwind WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TlsFree

user32

GetCursorPos SetCursorPos GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData SetWindowLongPtrW GetWindowLongPtrW GetDpiForSystem ClientToScreen SystemParametersInfoW LoadCursorW ScreenToClient MessageBoxW GetClientRect EmptyClipboard SetClipboardData CloseClipboard OpenClipboard IsIconic SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW WaitMessage PeekMessageW DispatchMessageW TranslateMessage ReleaseDC GetDC SetCursor SetProcessDPIAware

gdi32

GetDeviceCaps

shell32

ShellExecuteA SHCreateDirectoryExW

setupapi

SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

988KB

Virtual Size

988KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.hzstamp

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

HashSolution.exe

d3d11

dxgi

dcomp

d3dcompiler_47

ole32

winhttp

bcrypt

wintrust

advapi32

kernel32

user32

gdi32

shell32

setupapi

imm32

generic