24ecad197d71f3ab7fc514efbd0d86d77ef301e78a5c64c6f7ede029729cb77d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
24ecad197d71f3ab7fc514efbd0d86d77ef301e78a5c64c6f7ede029729cb77d.exe
Size 1.2MB
Sample261020-lk2casah84
SHA256 24ecad197d71f3ab7fc514efbd0d86d77ef301e78a5c64c6f7ede029729cb77d
MD5 24e8188a7d0f84eaff74856b2063c2ff
SHA1 64e0fc8ce0e5d2b3197e773368a5bbefd710cfae
SHA512 ac0f680810be7191cf4f1b4e674552899e4afb6cc50dbe5ec90a0327fb1bf25164027638d5dbd52f66fe0a666495646a868cb33fd7a28b03fad8b01d8a5f5670
SSDEEP 24576:yfbHUZFo4Ca3XNLep4NQXXCGrXEkHYvFQdMQei7ncpYLLT:WjUnXhfNQXxrXEkHurQ37nl
TLSH
T1B545AF55B2B841FCD07BE1B4AA56950BE732380507305ADF03D02A952F77AE45EBFB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24ecad197d71f3ab7fc514efbd0d86d77ef301e78a5c64c6f7ede029729cb77d.exe

File Explorer

24ecad197d71f3ab7fc514efbd0d86d77ef301e78a5c64c6f7ede029729cb77d.exe

.exe 1.2MB

24ecad197d71f3ab7fc514efbd0d86d77ef301e78a5c64c6f7ede029729cb77d.exe

IMPHASH 58f9d487a6c0c9b29c8356c29947d2d5
SHA256 24ecad197d71f3ab7fc514efbd0d86d77ef301e78a5c64c6f7ede029729cb77d
MD5 24e8188a7d0f84eaff74856b2063c2ff
SHA1 64e0fc8ce0e5d2b3197e773368a5bbefd710cfae
SHA512 ac0f680810be7191cf4f1b4e674552899e4afb6cc50dbe5ec90a0327fb1bf25164027638d5dbd52f66fe0a666495646a868cb33fd7a28b03fad8b01d8a5f5670
SSDEEP 24576:yfbHUZFo4Ca3XNLep4NQXXCGrXEkHYvFQdMQei7ncpYLLT:WjUnXhfNQXxrXEkHurQ37nl
TLSH
T1B545AF55B2B841FCD07BE1B4AA56950BE732380507305ADF03D02A952F77AE45EBFB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

678240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

user32

UnregisterClassW RegisterClassA CreateWindowExA OpenClipboard CloseClipboard GetClipboardData GetDC ReleaseDC RegisterClassExW CreateWindowExW DestroyWindow ShowWindow UpdateWindow SetWindowRgn MessageBoxW LoadCursorW LoadIconW SystemParametersInfoW MonitorFromPoint SetWindowPos GetWindowRect DefWindowProcW GetSystemMetrics GetMessageA DispatchMessageA SetCursorPos SystemParametersInfoA SetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture DefWindowProcA ReleaseCapture IsWindowUnicode GetForegroundWindow GetClientRect PeekMessageW SetCursor ClientToScreen ScreenToClient PostQuitMessage DispatchMessageW TranslateMessage GetCursorPos SetProcessDPIAware

gdi32

GetDeviceCaps SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateRoundRectRgn

advapi32

DuplicateTokenEx RegCloseKey RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegCreateKeyExW RegOpenKeyExA LookupPrivilegeValueA RevertToSelf ImpersonateLoggedOnUser GetUserNameA AdjustTokenPrivileges OpenProcessToken RegSetValueExW RegDeleteValueW RegDeleteKeyW

shell32

ShellExecuteW ShellExecuteA SHQueryRecycleBinW SHEmptyRecycleBinW

iphlpapi

GetAdaptersInfo

winhttp

WinHttpSendRequest WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpReceiveResponse

wininet

InternetOpenA InternetCloseHandle InternetConnectA InternetOpenUrlA InternetReadFile HttpOpenRequestA HttpSendRequestA

gdiplus

GdipGetImageEncodersSize GdipGetImageEncoders GdipFree GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdiplusStartup GdipAlloc

ole32

CoUninitialize CoInitialize CreateStreamOnHGlobal

urlmon

URLDownloadToFileA

crypt32

CryptUnprotectData

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey

ncrypt

NCryptOpenKey NCryptDecrypt NCryptFreeObject NCryptOpenStorageProvider NCryptFreeBuffer NCryptEnumKeys

kernel32

GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW TerminateProcess ExitProcess ReadFile FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc GetUserDefaultLCID EnumSystemLocalesW VirtualProtect GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation CompareStringW GetFileAttributesExW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapReAlloc HeapSize WriteConsoleW RtlUnwindEx RtlLookupFunctionEntry LoadLibraryExW LCMapStringW GetConsoleOutputCP GetLocaleInfoW FlushFileBuffers IsValidLocale GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize RaiseException RtlPcToFileHeader SetEndOfFile GetModuleHandleW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsDBCSLeadByte GetLocaleInfoA LoadLibraryA GetModuleHandleA FreeLibrary Sleep GetCurrentProcess SetProcessWorkingSetSize GetFileAttributesA GetWindowsDirectoryA CreateDirectoryA DeleteFileA GetComputerNameA GetDiskFreeSpaceExW GetVolumeInformationA GetSystemTimes GlobalMemoryStatusEx GetSystemInfo GetTickCount64 RtlUnwind GetProcAddress WideCharToMultiByte GetLastError SetLastError GetLogicalProcessorInformation GetFirmwareEnvironmentVariableA GetUserDefaultLocaleName GetEnvironmentVariableW DeleteFileW FindClose FindFirstFileW FindNextFileW RemoveDirectoryW SetFileAttributesW CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessW MultiByteToWideChar CreateFileW WriteFile GetTempPathW GetCurrentProcessId GetTickCount GetEnvironmentVariableA FindFirstFileA FindNextFileA GetTempPathA GetTempFileNameA OpenProcess GetLocalTime GlobalUnlock GlobalLock LocalFree WinExec CopyFileA CreateToolhelp32Snapshot Process32FirstW Process32NextW OutputDebugStringA GlobalAlloc GlobalFree VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

Name

.text

Size

900KB

Virtual Size

899KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

24ecad197d71f3ab7fc514efbd0d86d77ef301e78a5c64c6f7ede029729cb77d.exe

d3d11

dxgi

d3dcompiler_47

dwmapi

user32

gdi32

advapi32

shell32

iphlpapi

winhttp

wininet

gdiplus

ole32

urlmon

crypt32

bcrypt

ncrypt

kernel32

imm32

generic