89GdV0AhV0mxY1VQ[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
89GdV0AhV0mxY1VQ.exe
Size 7.2MB
Sample261020-rw14ka1vbv
SHA256 fc1cc9b5e242140027b4fd4e1c4bab4e8a517ca6fc5a1ff445c06e8d90f5df48
MD5 c5e7cdcc43145d044f14722e6cd51ca3
SHA1 a0d395a6ee7d6ad06416b71d613a6263ac7cd654
SHA512 f9af659cc125acd4ff062b3b95adddacb6a46aa56f9cb1cc0d6019f92772e6cfe6ea68595d2ae0f839d4a325d8dff4d66077dc335a81ec3de634c2c14b5ae550
SSDEEP 196608:MVHou730bpK3HC98CMCn2SXUB9pomf1v:MVHouIbpmHs8CMC2Scpomf1
TLSH
T14D7633F665CA0378EC12C7B8AD8625BDB36A3B440A624E1677CF6E002F53D79A47134D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89GdV0AhV0mxY1VQ.exe

File Explorer

89GdV0AhV0mxY1VQ.exe

.exe 7.2MB

89GdV0AhV0mxY1VQ.exe

IMPHASH 8a237c159bfb202bbb6ba1a340b8f11b
SHA256 fc1cc9b5e242140027b4fd4e1c4bab4e8a517ca6fc5a1ff445c06e8d90f5df48
MD5 c5e7cdcc43145d044f14722e6cd51ca3
SHA1 a0d395a6ee7d6ad06416b71d613a6263ac7cd654
SHA512 f9af659cc125acd4ff062b3b95adddacb6a46aa56f9cb1cc0d6019f92772e6cfe6ea68595d2ae0f839d4a325d8dff4d66077dc335a81ec3de634c2c14b5ae550
SSDEEP 196608:MVHou730bpK3HC98CMCn2SXUB9pomf1v:MVHouIbpmHs8CMC2Scpomf1
TLSH
T14D7633F665CA0378EC12C7B8AD8625BDB36A3B440A624E1677CF6E002F53D79A47134D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8070418

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

QueryPerformanceCounter

user32

GetClipboardData

advapi32

ConvertSidToStringSidA

shell32

ShellExecuteA

ntdll

memcmp

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

normaliz

IdnToAscii

wldap32

ord41

crypt32

CryptMsgClose

ws2_32

sendto

wininet

InternetGetConnectedState

dxgi

CreateDXGIFactory1

psapi

GetModuleInformation

wintrust

WinVerifyTrust

shlwapi

PathFindFileNameW

dwmapi

DwmSetWindowAttribute

d3d11

D3D11CreateDeviceAndSwapChain

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

dbghelp

MiniDumpWriteDump

imm32

ImmReleaseContext

d3dcompiler_47

D3DCompile

iphlpapi

GetAdaptersAddresses

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment

api-ms-win-crt-stdio-l1-1-0

setvbuf

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-string-l1-1-0

_strdup

Name

.text

Size

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.y68x1h5

Size

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.y68x1h5

Size

1024B

Virtual Size

984B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.y68x1h5

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

89GdV0AhV0mxY1VQ.exe

kernel32

user32

advapi32

shell32

ntdll

msvcp140

normaliz

wldap32

crypt32

ws2_32

wininet

dxgi

psapi

wintrust

shlwapi

dwmapi

d3d11

api-ms-win-shcore-scaling-l1-1-1

dbghelp

imm32

d3dcompiler_47

iphlpapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

generic