www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-d7pysafv8w
SHA256 980a07480e887d80023ef9043a62c8265fc2519e976d4e9ffab4e469a08401a0
MD5 9f7b1e82445f1e2132aef53e1ff10ed4
SHA1 93dc0ce3c95f562446bb0669c25b1e428a2e31df
SHA512 aeb3907617f6f8103cb59ce2a87e8b926f302aac6976942e0afa903c1bed5778149adf03f88fe9c620e0ea483250cf58924500e704fa04e323b89cf8c63f619c
SSDEEP 49152:myuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbz:CUjFqquuu6f9Aau1lZIUH0PgExyDbbz
TLSH
T1E3D5335FD1EB0D94F9B82132718C1A86FF012E8AF6C5509CF4F10966E7B3A1A6BC4970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.07.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.07.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 980a07480e887d80023ef9043a62c8265fc2519e976d4e9ffab4e469a08401a0
MD5 9f7b1e82445f1e2132aef53e1ff10ed4
SHA1 93dc0ce3c95f562446bb0669c25b1e428a2e31df
SHA512 aeb3907617f6f8103cb59ce2a87e8b926f302aac6976942e0afa903c1bed5778149adf03f88fe9c620e0ea483250cf58924500e704fa04e323b89cf8c63f619c
SSDEEP 49152:myuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbz:CUjFqquuu6f9Aau1lZIUH0PgExyDbbz
TLSH
T1E3D5335FD1EB0D94F9B82132718C1A86FF012E8AF6C5509CF4F10966E7B3A1A6BC4970
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.07.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 2b91b1a9982729433cd98b5a196a9a9b60dc6e4fe46cb756e020968df1f0f15e
MD5 c1a3ba1b8a6d454ef1622f68d83c3e40
SHA1 aef5e09bb9b69abf7e2aa40187484b5389478f89
SHA512 2a0ed0fa2595866590d8fb0d3a470d676a88f4b45ae44c41c9e01858f4fdae9aaf6117856a7abaf190fc283e704145acbc063824ef73a00582c6f4761d35a014
SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYw:4C/p+HuPOc4N
TLSH
T1BE67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW