20223F3F326528273E29[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
20223F3F326528273E29.exe
Size 3.8MB
Sample261023-vx44dszsav
SHA256 d95ac8452921ca597965a76990f14bd4fa19c3c7200dcad395087a13682d275f
MD5 3d5d0d219e8e00b89e2fbc64c9b0c5f0
SHA1 96202aa664184757a16deaf5916f333283b23650
SHA512 f707dbb0fd85512c6efa1f3fd2a3e5eefa4ccc42f49e6e67d70454f055acb18b2c707a7f029980f5126f1f2c3796b96200b4e909e5315b9070f2e5dde9b3435b
SSDEEP 49152:/+teCu2nD4EpCjO5R32Yl9KSLubqol7XmR4NxDe60jIkrj0PPT65n2esACX20:GV8324Le8xDGjIznT6QX
TLSH
T15506AE42F2A1C5ACD02699788E67EA5AD6323C056F1046CB32DC7F1E2FB73D14AB7611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20223F3F326528273E29.exe

File Explorer

20223F3F326528273E29.exe

.exe 3.8MB

20223F3F326528273E29.exe

IMPHASH d9cfc9e2380fddb5d7d97b3eb57f7f43
SHA256 d95ac8452921ca597965a76990f14bd4fa19c3c7200dcad395087a13682d275f
MD5 3d5d0d219e8e00b89e2fbc64c9b0c5f0
SHA1 96202aa664184757a16deaf5916f333283b23650
SHA512 f707dbb0fd85512c6efa1f3fd2a3e5eefa4ccc42f49e6e67d70454f055acb18b2c707a7f029980f5126f1f2c3796b96200b4e909e5315b9070f2e5dde9b3435b
SSDEEP 49152:/+teCu2nD4EpCjO5R32Yl9KSLubqol7XmR4NxDe60jIkrj0PPT65n2esACX20:GV8324Le8xDGjIznT6QX
TLSH
T15506AE42F2A1C5ACD02699788E67EA5AD6323C056F1046CB32DC7F1E2FB73D14AB7611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

387312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

dwmapi

DwmSetWindowAttribute

d2d1

ord1

ole32

CoInitializeEx CoCreateInstance

winhttp

WinHttpOpen WinHttpSetTimeouts WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpCloseHandle

iphlpapi

GetAdaptersInfo

kernel32

GetCommandLineA GetCPInfo GetOEMCP GetACP GetCommandLineW FindFirstFileExW GetFileSizeEx GetConsoleOutputCP GetEnvironmentStringsW IsValidCodePage GetEnvironmentVariableW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFullPathNameW WriteFile GetTempPathW CloseHandle WaitForSingleObject CreateRemoteThread OpenProcess GetTickCount64 VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW MultiByteToWideChar CheckRemoteDebuggerPresent GetCurrentProcess lstrcpynW SetEnvironmentVariableW GlobalUnlock GetProcessHeap GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA LCMapStringW CompareStringW LoadLibraryExW VirtualProtect SetFilePointerEx ReadConsoleW GetConsoleMode GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW TerminateProcess GetTimeZoneInformation ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread ReadFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlushFileBuffers SetStdHandle GetStringTypeW HeapSize FlsGetValue FlsAlloc HeapReAlloc SetEndOfFile FreeEnvironmentStringsW GlobalLock WriteConsoleW GlobalAlloc GetLastError GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError

user32

LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode SetCapture GetCapture GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CharLowerW SystemParametersInfoW MessageBoxW UpdateWindow ReleaseCapture ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetClipboardData GetKeyState

shell32

ShellExecuteA

advapi32

OpenSCManagerW CloseServiceHandle RegQueryValueExW RegOpenKeyExW RegCloseKey OpenServiceW

Name

.text

Size

539KB

Virtual Size

539KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

158KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

20223F3F326528273E29.exe

d3d11

d3dcompiler_47

imm32

dwmapi

d2d1

ole32

winhttp

iphlpapi

kernel32

user32

shell32

advapi32

generic