8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe
Size 1.9MB
Sample261022-xjrl9atthv
SHA256 8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844
MD5 70868e22e61dba75f71b243dec3d33a3
SHA1 6c9eaff49c963a100b8a253afbc6658c6c5db374
SHA512 2269b8241b3eb2c82833a1ba890233c34ca6ce6cb762c06500d08cc75aa22acb55f7f6bb7e457dce5c619fdcbd98110ce8b35829ae47594fa47be2253f563914
SSDEEP 49152:vt1+Q8HJUk5j3rwsWPVO2xiNWAXIU6isA60L:vb3I7MBxUC+sO
TLSH
T1FD956C03F69580FCC55EC07887479632EA22BC8D092576EB2BD09B653E76F909F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe

File Explorer

8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe

.exe 1.9MB

8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe

IMPHASH d436939e4edad1b901cb7ffa9ab98595
SHA256 8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844
MD5 70868e22e61dba75f71b243dec3d33a3
SHA1 6c9eaff49c963a100b8a253afbc6658c6c5db374
SHA512 2269b8241b3eb2c82833a1ba890233c34ca6ce6cb762c06500d08cc75aa22acb55f7f6bb7e457dce5c619fdcbd98110ce8b35829ae47594fa47be2253f563914
SSDEEP 49152:vt1+Q8HJUk5j3rwsWPVO2xiNWAXIU6isA60L:vb3I7MBxUC+sO
TLSH
T1FD956C03F69580FCC55EC07887479632EA22BC8D092576EB2BD09B653E76F909F0DB19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

CancelIo CancelIoEx CloseHandle CopyFileExW CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateWaitableTimerExW DuplicateHandle FindClose FindFirstFileExW FlsAlloc FlsFree FlsSetValue GetCurrentProcess GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetOverlappedResult GetQueuedCompletionStatusEx InitOnceBeginInitialize InitOnceComplete IsThreadAFiber OpenProcess PostQueuedCompletionStatus ReadFile ReadFileEx SetFileCompletionNotificationModes SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForMultipleObjects WaitForSingleObject WriteFile WriteFileEx AddVectoredExceptionHandler CompareStringOrdinal CreateFileMappingA CreateToolhelp32Snapshot FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetTickCount64 GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetUnhandledExceptionFilter UnmapViewOfFile WriteConsoleW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

ws2_32

WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

user32

GetCursorPos GetDC GetDesktopWindow GetSystemMetrics ReleaseDC SendInput SetCursorPos

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

528KB

Virtual Size

528KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8e32318c67f2f342d060a2d689907886e595583733eec9c426585aa1e60fa844.exe

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

ws2_32

advapi32

gdi32

user32

bcrypt

msvcrt

generic