94f232a3-0861-4f56-b2ec-d55ce62f19f7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
94f232a3-0861-4f56-b2ec-d55ce62f19f7.exe
Size 110KB
Sample261014-a3333att6k
SHA256 2140a3ca94a8c8e176b813e47ae8f346cfd1c692737e26ad94b94845088a8eaf
MD5 d624f5dd1eaffde05f18ecbe6ab835fd
SHA1 d414e4eedce626002795a5a07bf6207a07691e70
SHA512 3cbfb92ec4359e3486a44b8fdcee46c861a03f39c329a009ce9d5d80f3b1533cc36c63e7d42de32022b5493e7d728cbcb4e8cd1c5e8260bbad03a1f53ef12aa4
SSDEEP 768:UEsX2YQMwqb6mqjJc4OaODCK5I8BEcj3eaSfMeS8NujfurSHTCJE+HiMq:gQg6v85IL6uaS0MyGOeEM
TLSH
T11EB3C42ABE15902EC255D9B4D9538E01DE317C854B616ACF73A07FEE0E327D4AF3A901
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94f232a3-0861-4f56-b2ec-d55ce62f19f7.exe

File Explorer

94f232a3-0861-4f56-b2ec-d55ce62f19f7.exe

.exe 110KB

94f232a3-0861-4f56-b2ec-d55ce62f19f7.exe

IMPHASH 3b5e1b0000bc8a8213bdedcd423984ea
SHA256 2140a3ca94a8c8e176b813e47ae8f346cfd1c692737e26ad94b94845088a8eaf
MD5 d624f5dd1eaffde05f18ecbe6ab835fd
SHA1 d414e4eedce626002795a5a07bf6207a07691e70
SHA512 3cbfb92ec4359e3486a44b8fdcee46c861a03f39c329a009ce9d5d80f3b1533cc36c63e7d42de32022b5493e7d728cbcb4e8cd1c5e8260bbad03a1f53ef12aa4
SSDEEP 768:UEsX2YQMwqb6mqjJc4OaODCK5I8BEcj3eaSfMeS8NujfurSHTCJE+HiMq:gQg6v85IL6uaS0MyGOeEM
TLSH
T11EB3C42ABE15902EC255D9B4D9538E01DE317C854B616ACF73A07FEE0E327D4AF3A901
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\iv\Documents\pluh\woof\x64\Release\Defiant Temp V1.pdb

kernel32

GetCurrentProcess GetStdHandle SetConsoleMode WaitForSingleObject GetConsoleMode GetTempPathA GetLastError CreateFileA DeleteFileA SetConsoleTitleA Beep GetConsoleWindow CreateProcessA CreateDirectoryA GetExitCodeProcess InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetConsoleScreenBufferInfo CloseHandle GetModuleFileNameA GetModuleHandleW Sleep GetCurrentThreadId SetUnhandledExceptionFilter

user32

GetWindowLongW SetLayeredWindowAttributes SetWindowLongW

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteA

msvcp140

_Thrd_join ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ _Thrd_id ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency _Query_perf_counter ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __std_terminate __C_specific_handler memmove __std_exception_destroy _CxxThrowException __current_exception_context __current_exception memcpy memset __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

exit _exit _initterm_e _initterm _register_onexit_function __p___argv _c_exit _register_thread_local_exe_atexit_callback _set_app_type _configure_narrow_argv _cexit _crt_atexit _initialize_onexit_table terminate _get_initial_narrow_environment system _beginthreadex __p___argc _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_pclose fgets _popen __p__commode _set_fmode

api-ms-win-crt-string-l1-1-0

strlen strcpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale