umpmhgpkxfw59v0fmb63vq7i[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
umpmhgpkxfw59v0fmb63vq7i.exe
Size 2.2MB
Sample261024-2j4n2axvdv
SHA256 10e13ccb2589596e671bd3458ce160ce6edc0b55d3938fa8df2ad8ff6a9a6bed
MD5 0ec71ef277c9995ff09d16ec9c58a98f
SHA1 73681647081763323420e8019f8c0f7e9f2f18a4
SHA512 19c5dbbeb1d529697b2c0043952e186d95268b046f2c1746e59eed5fa541dd4837599e09ac5477b3edd34e9bfcd23b91e77562ba1b44c1476a04719cb1cff7d8
SSDEEP 49152:4RP8eX0Bry+ShBR1rVJ2wwwYPs0DF8s7hdkpuPvwbgY2i:0XSyxhB9J2wv2V7hdkpuPvwbk
TLSH
T1F0B5B007A6D500F4D3BEC578C56A8183E671B429D3A4C6EF23E859A50F236D71BF6B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
umpmhgpkxfw59v0fmb63vq7i.exe

File Explorer

umpmhgpkxfw59v0fmb63vq7i.exe

.exe 2.2MB

umpmhgpkxfw59v0fmb63vq7i.exe

IMPHASH fd937e215022f64d1cc172763e934179
SHA256 10e13ccb2589596e671bd3458ce160ce6edc0b55d3938fa8df2ad8ff6a9a6bed
MD5 0ec71ef277c9995ff09d16ec9c58a98f
SHA1 73681647081763323420e8019f8c0f7e9f2f18a4
SHA512 19c5dbbeb1d529697b2c0043952e186d95268b046f2c1746e59eed5fa541dd4837599e09ac5477b3edd34e9bfcd23b91e77562ba1b44c1476a04719cb1cff7d8
SSDEEP 49152:4RP8eX0Bry+ShBR1rVJ2wwwYPs0DF8s7hdkpuPvwbgY2i:0XSyxhB9J2wv2V7hdkpuPvwbk
TLSH
T1F0B5B007A6D500F4D3BEC578C56A8183E671B429D3A4C6EF23E859A50F236D71BF6B02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

912396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

IsDebuggerPresent SetThreadPriority DeleteFileA CreateSemaphoreExW GetCurrentThread Sleep FreeLibrary ExitProcess GetProcAddress FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW RtlUnwind PeekNamedPipe GetEnvironmentVariableA SleepEx GetSystemDirectoryW MoveFileExW DebugBreak AreFileApisANSI GetFullPathNameW GetFileInformationByHandle FindFirstFileW GetCurrentDirectoryW lstrcmpW WideCharToMultiByte GetModuleHandleW GetProcessHeap GetCurrentProcessId CloseHandle LoadLibraryA GetLastError OpenProcess GetModuleHandleA WaitForSingleObject FindClose FindNextFileA GetUserDefaultLocaleName TerminateProcess CreateMutexExW HeapAlloc LoadLibraryW OpenSemaphoreW WaitForSingleObjectEx OutputDebugStringW FormatMessageW MultiByteToWideChar ReleaseMutex GetCurrentThreadId GetModuleFileNameW GetModuleHandleExW ReleaseSemaphore SetLastError CopyFileW HeapFree GetCurrentProcess FindFirstFileA WaitForMultipleObjects WriteConsoleW FormatMessageA RtlPcToFileHeader RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive IsProcessorFeaturePresent LocalFree GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW SwitchToThread GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetSystemTimeAsFileTime GetFileInformationByHandleEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead SetEvent CreateThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW VerSetConditionMask VerifyVersionInfoW DuplicateHandle InterlockedPushEntrySList UnmapViewOfFile GetSystemInfo GetFileSizeEx WriteFile SetEndOfFile CreateMutexA CreateFileA CreateFileMappingA RemoveDirectoryA CreateDirectoryA CreateSemaphoreA GetTickCount MapViewOfFileEx GetProcessTimes Process32First GetProcessId CreateToolhelp32Snapshot Process32Next GetExitCodeProcess CreateFileW ReadFile RtlUnwindEx InitializeCriticalSectionAndSpinCount ExitThread GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileAttributesExW GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateDirectoryW GetTimeZoneInformation FlushFileBuffers ReadConsoleW HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle DeleteFileW HeapSize GetModuleFileNameA

user32

DestroyWindow GetAncestor ReleaseCapture UpdateWindow SetWindowLongPtrA DefWindowProcW LoadImageA GetMessageW RegisterClassExA PostMessageW SetWindowPos SetProcessDpiAwarenessContext LoadCursorA CreateWindowExA GetParent PostQuitMessage GetClientRect SendMessageA TranslateMessage SetFocus DefWindowProcA AdjustWindowRect MoveWindow GetWindowLongA CallWindowProcA SetWindowLongA DispatchMessageW IsWindow ShowWindow GetWindowPlacement RegisterClassExW GetWindowLongPtrW SetWindowTextW GetSystemMetrics CreateWindowExW PostMessageA SetWindowLongPtrW LoadIconA

advapi32

CryptEncrypt SetSecurityDescriptorDacl RegGetValueA RegCreateKeyExA RegQueryValueExA RegSetValueExA RegOpenKeyExA RegCloseKey RegOpenKeyExW RegQueryValueExW InitializeSecurityDescriptor CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey

shell32

SHGetFolderPathW ShellExecuteExA

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CoTaskMemAlloc

shlwapi

PathCombineW PathFindFileNameW

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

crypt32

CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine

bcrypt

BCryptGenRandom

ws2_32

recv setsockopt socket WSAIoctl __WSAFDIsSet select htonl getsockname getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname getpeername getsockopt htons connect bind accept WSACleanup WSAStartup inet_ntop WSASetLastError ntohs inet_pton send closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent listen WSACloseEvent WSAGetLastError