file_a6357da6a05d7266[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
file_a6357da6a05d7266.exe
Size 3.7MB
Sample261017-hf1nesyth1
SHA256 f5ebd8f8e5217df1c726beb523c00d49992d6d205589509cbe2c581b6aab29b6
MD5 5d33be3d56370950293ca9826efa3ec7
SHA1 53af44484800b7d7c16ef65f4520d58da8449d62
SHA512 5bdc6fe2c02cf552d0cc19412088cfbd9ce592a6308d3231559ae27c6f46e5afbd2975bd4e1275e65bd296ea506d6d9b78754d39592d5bb433aacd80eccf579a
SSDEEP 49152:Z/zJ3JLdWXMIyD7OM7Sq6j+hHuMsiSdvf1g/zRlWhgMBR4JOnb5h:7yr1DgpIdh
TLSH
T166064B05F25A10AED487C5B486464A23DE3474DB1B36AAEF42C0D2363FBA7F45B39B14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file_a6357da6a05d7266.exe

File Explorer

file_a6357da6a05d7266.exe

.exe 3.7MB

file_a6357da6a05d7266.exe

IMPHASH 5dc656cca9effbda0d429dcfe08805a3
SHA256 f5ebd8f8e5217df1c726beb523c00d49992d6d205589509cbe2c581b6aab29b6
MD5 5d33be3d56370950293ca9826efa3ec7
SHA1 53af44484800b7d7c16ef65f4520d58da8449d62
SHA512 5bdc6fe2c02cf552d0cc19412088cfbd9ce592a6308d3231559ae27c6f46e5afbd2975bd4e1275e65bd296ea506d6d9b78754d39592d5bb433aacd80eccf579a
SSDEEP 49152:Z/zJ3JLdWXMIyD7OM7Sq6j+hHuMsiSdvf1g/zRlWhgMBR4JOnb5h:7yr1DgpIdh
TLSH
T166064B05F25A10AED487C5B486464A23DE3474DB1B36AAEF42C0D2363FBA7F45B39B14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2523064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AreFileApisANSI CancelIo CloseHandle CloseThreadpoolWork CompareStringEx CompareStringW ConnectNamedPipe CopyFileW CreateEventW CreateFile2 CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread CreateThreadpoolWork CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushConsoleInputBuffer FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalDrives GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetNumberOfConsoleInputEvents GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLocaleName GetSystemFirmwareTable GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetTickCount GetTickCount64 GetTimeZoneInformation GetUserDefaultLCID GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetProcessMemoryInfo LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekConsoleInputA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleInputW ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCP SetConsoleMode SetConsoleOutputCP SetEndOfFile SetEnvironmentVariableW SetEvent SetFileInformationByHandle SetFilePointer SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SubmitThreadpoolWork SystemTimeToFileTime TerminateProcess TryAcquireSRWLockExclusive TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile VirtualAllocEx VirtualProtect VirtualProtectEx WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

advapi32

CloseServiceHandle CreateProcessWithTokenW CredEnumerateW CredFree DuplicateTokenEx GetTokenInformation GetUserNameW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegEnumKeyExW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW StartServiceW

iphlpapi

GetAdaptersInfo

user32

EnumDisplayDevicesW EnumDisplaySettingsW GetDC GetSystemMetrics ReleaseDC ShowWindow

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWriteData

crypt32

CryptUnprotectData

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanOpenHandle WlanQueryInterface

vssapi

CreateVssBackupComponentsInternal VssFreeSnapshotPropertiesInternal

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize CreateStreamOnHGlobal

shell32

SHGetFolderPathW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

mf

MFEnumDeviceSources

mfplat

MFCreateAttributes MFCreateMediaType MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

807KB

Virtual Size

807KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

181KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file_a6357da6a05d7266.exe

kernel32

advapi32

iphlpapi

user32

winhttp

crypt32

bcrypt

wlanapi

vssapi

ole32

shell32

gdi32

mf

mfplat

mfreadwrite

generic