Gff_24d7e507[.]exe

General

Target
Gff_24d7e507.exe
Size 932KB
Sample261017-ma925ady2t
SHA256 42a3eb1efb985e250d7bdc852b308c0d26e9ca4e3ee37fe875687f0763a6437b
MD5 7987a649ec172b1d6e2b365ba4852085
SHA1 2745052b68d850f540fc68daeebc9509080cf4e4
SHA512 e55a0e203eb535c22413b194517f48423462a0ac767adea3832ae25386a5085cea47e54d6416fd67ad9fa71a4644570719a0ab55acd74e82464f44a54b862d93
SSDEEP 24576:ISjpd5bbYGoLdvYagVwOa8J8A80QRE5OGE1:IOdl0jdvYhS+k0QqgGE1
TLSH
T12B15232CCC37A1BBCB94DEB5E81185968B605DC7DB9570C7A7452CF9A090AE4E3B6303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Gff_24d7e507.exe

File Explorer

Gff_24d7e507.exe

.exe 932KB

Gff_24d7e507.exe

IMPHASH a3ed0644586c44355411d13b114e78e8
SHA256 42a3eb1efb985e250d7bdc852b308c0d26e9ca4e3ee37fe875687f0763a6437b
MD5 7987a649ec172b1d6e2b365ba4852085
SHA1 2745052b68d850f540fc68daeebc9509080cf4e4
SHA512 e55a0e203eb535c22413b194517f48423462a0ac767adea3832ae25386a5085cea47e54d6416fd67ad9fa71a4644570719a0ab55acd74e82464f44a54b862d93
SSDEEP 24576:ISjpd5bbYGoLdvYagVwOa8J8A80QRE5OGE1:IOdl0jdvYhS+k0QqgGE1
TLSH
T12B15232CCC37A1BBCB94DEB5E81185968B605DC7DB9570C7A7452CF9A090AE4E3B6303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

13472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetTempFileNameW SetUnhandledExceptionFilter CreateProcessW GetTempPathW GetModuleFileNameW WriteFile CloseHandle CreateFileW GetFileSizeEx ReadFile

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __std_exception_destroy __std_exception_copy memcpy memmove memset __C_specific_handler __current_exception

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __p__commode _set_fmode

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing