49e0b11c6988bf7acb3cad9c3c267a8aabc31bb1dc422ae9811cdd4ea66a25dd[.]exe

General

Target
49e0b11c6988bf7acb3cad9c3c267a8aabc31bb1dc422ae9811cdd4ea66a25dd.exe
Size 1.1MB
Sample261023-lfe89sxtds
SHA256 49e0b11c6988bf7acb3cad9c3c267a8aabc31bb1dc422ae9811cdd4ea66a25dd
MD5 f0822425f44551ba600204c5ae73c661
SHA1 62631bacf64ccf513a607d6b1a6870046826bf8d
SHA512 a56bca51b31434d9e0314a932ff6b6ea7c89e9d954674cac90639e216643f452b5839f76963e538aa30aad507b0e6b2581740d4b72f5bb02364ae5f311a786af
SSDEEP 12288:MJDz8YX3cC2eoL3SR6nM1GfnXwJQSv5Wu9xpwBQhia9l+fgWBnyAuKzo8h1mjoVP:CQYXmuRNkAJbhdhiaqfeAfVmM
TLSH
T1AC45BD74B651D9ADD92982F486D773209A67F83D0710D4BBC2881E860DFF6BCBB63610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49e0b11c6988bf7acb3cad9c3c267a8aabc31bb1dc422ae9811cdd4ea66a25dd.exe

File Explorer

49e0b11c6988bf7acb3cad9c3c267a8aabc31bb1dc422ae9811cdd4ea66a25dd.exe

.exe 1.1MB

49e0b11c6988bf7acb3cad9c3c267a8aabc31bb1dc422ae9811cdd4ea66a25dd.exe

IMPHASH b36ba994963e9a842d3a5984acc85b92
SHA256 49e0b11c6988bf7acb3cad9c3c267a8aabc31bb1dc422ae9811cdd4ea66a25dd
MD5 f0822425f44551ba600204c5ae73c661
SHA1 62631bacf64ccf513a607d6b1a6870046826bf8d
SHA512 a56bca51b31434d9e0314a932ff6b6ea7c89e9d954674cac90639e216643f452b5839f76963e538aa30aad507b0e6b2581740d4b72f5bb02364ae5f311a786af
SSDEEP 12288:MJDz8YX3cC2eoL3SR6nM1GfnXwJQSv5Wu9xpwBQhia9l+fgWBnyAuKzo8h1mjoVP:CQYXmuRNkAJbhdhiaqfeAfVmM
TLSH
T1AC45BD74B651D9ADD92982F486D773209A67F83D0710D4BBC2881E860DFF6BCBB63610
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

87440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

daidriski.pdb

kernel32

CloseHandle CompareStringOrdinal CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetThreadTimes HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

user32

GetActiveWindow GetDoubleClickTime GetFocus GetForegroundWindow GetKeyboardType SystemParametersInfoW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile

Name

.text

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

416KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

312KB

Virtual Size

314KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

201B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

49e0b11c6988bf7acb3cad9c3c267a8aabc31bb1dc422ae9811cdd4ea66a25dd.exe

kernel32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic