www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261023-ms1amsa161
SHA256 c9f54832bcb46a562e2a3f907a648e047043de873ad209ef0f6f7c731fdb653b
MD5 9a0cc573e59a4725aa6bd4d947ce2876
SHA1 6524675a46112c7bfa0e9b04c111aec211d671f1
SHA512 ca5179e4af85437357182ebba20233ad0c0eb1ea2f9100020fbb09a1f05e9e1e07d9c473e1652d63df85e03b96c62d5bf86a48710bbc232bdfc0a42059087261
SSDEEP 49152:BQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWcf:BQu32Ky/KqjKRLz3hVV79pdrdGAqUA+z
TLSH
T187D53397CAA71794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.04.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.04.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 c9f54832bcb46a562e2a3f907a648e047043de873ad209ef0f6f7c731fdb653b
MD5 9a0cc573e59a4725aa6bd4d947ce2876
SHA1 6524675a46112c7bfa0e9b04c111aec211d671f1
SHA512 ca5179e4af85437357182ebba20233ad0c0eb1ea2f9100020fbb09a1f05e9e1e07d9c473e1652d63df85e03b96c62d5bf86a48710bbc232bdfc0a42059087261
SSDEEP 49152:BQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWcf:BQu32Ky/KqjKRLz3hVV79pdrdGAqUA+z
TLSH
T187D53397CAA71794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF7
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.04.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 4027d454c1bdac286d3d0ace4c790ae9d683cb384047fd7dc3f480aed3b8fd75
MD5 fbd69e43140a8a5a9865baac999adfbb
SHA1 9d42edfcefbe0fdd568cabe624575df775fdc115
SHA512 610d26a7a4f7966440d21fd6b6ee7ff20772a5c509cf8e2814f94cc843a240f8070d5d31fe8f255dbd1eb31ffbcdc96d473f23e7b4cad770ec35533553fef6d1
SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY9:TC/p+HuPOc4M
TLSH
T1A067181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW