b96n6ns[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
b96n6ns.exe
Size 6.5MB
Sample261018-rba2msbc56
SHA256 f984f2574f8171a10df25d084a87045d6d3ef3e866a4d0315c159da53a5d079c
MD5 b4df696fa14f8c5d0cb4d4edc371b066
SHA1 033543536de45594be09b2dba9d97093fb8beb6f
SHA512 036781e3f48ce883a7ae59f3c685aade042e5135ce988d1f03d6510c842c90d6ca94165154789278c6ba9bc999c372ce7d043e80e9494e8defe62a4b8b9f343d
SSDEEP 98304:jCEzCycHxkOt0y/57oIhuE0CeVMNvVDi7AKL3+4xY1sMgB3HB3bcYlKU1i:GpxXB/tosuVCxvs/L+IMgB3HB3bcTv
TLSH
T1126623B6B6A901EDC1A650B81D28A522D672349E07F49FDF432085A52F13BDC673F2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b96n6ns.exe

File Explorer

b96n6ns.exe

.exe 6.5MB

b96n6ns.exe

IMPHASH 79e1574cb27075b58c53a2198ef27277
SHA256 f984f2574f8171a10df25d084a87045d6d3ef3e866a4d0315c159da53a5d079c
MD5 b4df696fa14f8c5d0cb4d4edc371b066
SHA1 033543536de45594be09b2dba9d97093fb8beb6f
SHA512 036781e3f48ce883a7ae59f3c685aade042e5135ce988d1f03d6510c842c90d6ca94165154789278c6ba9bc999c372ce7d043e80e9494e8defe62a4b8b9f343d
SSDEEP 98304:jCEzCycHxkOt0y/57oIhuE0CeVMNvVDi7AKL3+4xY1sMgB3HB3bcYlKU1i:GpxXB/tosuVCxvs/L+IMgB3HB3bcTv
TLSH
T1126623B6B6A901EDC1A650B81D28A522D672349E07F49FDF432085A52F13BDC673F2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16183488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptDestroyKey BCryptImportKeyPair BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty

winhttp

WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpOpen

kernel32

WriteConsoleW CreateFileW HeapReAlloc HeapSize ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP ExitProcess GetModuleFileNameA MultiByteToWideChar GetCommandLineA GetEnvironmentVariableA SetUnhandledExceptionFilter AddVectoredExceptionHandler HeapAlloc HeapFree GetProcessHeap Sleep GetCurrentThreadId TlsGetValue TlsSetValue CreateDirectoryA CreateFileA GetFileAttributesA WriteFile CloseHandle GetLastError GetCurrentProcessId GetACP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx RtlUnwind SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindClose FindFirstFileExW FindNextFileW IsValidCodePage

Name

.nximg

Size

512B

Virtual Size

15.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

YHQPN75D

Size

567KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

AGNDUWA6

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

HGDWX6UO

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PDQUU8YX

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

QUS64C0P

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

5R8XXM5T

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

9BZK429Q

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

54054347

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nxunw

Size

459KB

Virtual Size

459KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b96n6ns.exe

bcrypt

winhttp

kernel32

generic