www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-d45vtshv8n
SHA256 5be65f955cf21b680ddba80d004f8eda8b1ed9b32a9a5c2a38a9b59c3664b4f6
MD5 8b106a921863a2010daad440b5d8138a
SHA1 c2c53fff8d8110c6a8d9a0fa3a5911dd04a0d82e
SHA512 4a508e313b93f07dc39d0c7c7e70a317b7f5db92052df14f162b01439819acfe05a7846cb2a3eb90efa777f3c8353ef1055c198a01efd389040a53ee20f194e7
SSDEEP 49152:Mdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcB:TcypfByHqEJI5fixqBN7k0aa/waDPG
TLSH
T180D5330A50ABE3C1EA365D370F206035B6A86DB438942DDCB5CAA5C58934E7C48E7DDF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.06.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.06.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 5be65f955cf21b680ddba80d004f8eda8b1ed9b32a9a5c2a38a9b59c3664b4f6
MD5 8b106a921863a2010daad440b5d8138a
SHA1 c2c53fff8d8110c6a8d9a0fa3a5911dd04a0d82e
SHA512 4a508e313b93f07dc39d0c7c7e70a317b7f5db92052df14f162b01439819acfe05a7846cb2a3eb90efa777f3c8353ef1055c198a01efd389040a53ee20f194e7
SSDEEP 49152:Mdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcB:TcypfByHqEJI5fixqBN7k0aa/waDPG
TLSH
T180D5330A50ABE3C1EA365D370F206035B6A86DB438942DDCB5CAA5C58934E7C48E7DDF
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.06.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 b369e93a805502fb22f9b5337137c12e81cecfca1f702c739a27c19090e66e32
MD5 11477ffb6abfd2fbfa9cf85c61fb3ca3
SHA1 bfb46927caa4c1ac6643630364fe4b6a102df34e
SHA512 b4b0725784605e10ea98c669ee696148f8ba0b46982903f2a090bc5f247b8918457c993f2ddef96f5de21edd40f9264686c62222b856ec7ceac3e603847c5f41
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYp:YC/p+HuPOc4U
TLSH
T1F667181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW