www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261023-sdh1psew5l
SHA256 883dc8b45b30a1e30d836faef9f8314cd56925d57005749f4629948978e625ac
MD5 54b239655d166d7dd6ab7f18c2cf72b0
SHA1 8823679418a74e0e10654c6a77e8fe2fd705f4e5
SHA512 6b2959b385c1454fb4b6e3d4ba22a1d9c0e59a023a0dc4087d0be5a74a09f562790e7ca82f8ca3c386db53bdc5345f2568b1118652ea136419a983d070a33a55
SSDEEP 49152:gdcB+zKw8pG3d9mY/RJDXe86hd/u8/4RDiaHwxl8sBQL5tzuRB30gS2fdw+Me:gCBEv8pUdUa3Xe86hd/GDuxl8sBccRVX
TLSH
T1F6D53390CA0FD61AF3199075062B30ABFBB962843C7765C84C7C129748A2CDD5FA9DF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.13.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.13.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 883dc8b45b30a1e30d836faef9f8314cd56925d57005749f4629948978e625ac
MD5 54b239655d166d7dd6ab7f18c2cf72b0
SHA1 8823679418a74e0e10654c6a77e8fe2fd705f4e5
SHA512 6b2959b385c1454fb4b6e3d4ba22a1d9c0e59a023a0dc4087d0be5a74a09f562790e7ca82f8ca3c386db53bdc5345f2568b1118652ea136419a983d070a33a55
SSDEEP 49152:gdcB+zKw8pG3d9mY/RJDXe86hd/u8/4RDiaHwxl8sBQL5tzuRB30gS2fdw+Me:gCBEv8pUdUa3Xe86hd/GDuxl8sBccRVX
TLSH
T1F6D53390CA0FD61AF3199075062B30ABFBB962843C7765C84C7C129748A2CDD5FA9DF9
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.13.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 81187cc1f4a44e2ea041c7a2221eb2696587b3f237ade656804cbd80f15dc039
MD5 796d22caa0f354e7b996afe3c4b5f5e3
SHA1 93d33d3792131e37d8ae6e8f584610de1c20acb3
SHA512 1472ab3dc256b13b95946c542154dc05cacc71751dc6e080ba8bd16a5cbf840c5e6752e7a88f4b2090df39054cc6344e4c99ab4afc18d9040fd846372adb908c
SSDEEP 196608:CZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYi:ZC/p+HuPOc4T
TLSH
T11F67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW