www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-e9fnkafx8v
SHA256 88786006efa36dfd40130e5f48fd7bd8d40c061d0b6de5c7f139c10f7b113cf4
MD5 70a70b9908b8b5b5d96912c80df4995e
SHA1 df79a089a93360dc921bcb950675a66a6922eb37
SHA512 7258d1867480cf24cd43765f33579f4a3b4159ea90db214f7f5dbaa851e1fb6fddabf57004125c9335736951cda27c1abaea77e17beeb5ab818709a0a6893e57
SSDEEP 49152:6yuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebby:+UjFqquuu6f9Aau1lZIUH0PgExyDbby
TLSH
T114D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.08.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.08.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 88786006efa36dfd40130e5f48fd7bd8d40c061d0b6de5c7f139c10f7b113cf4
MD5 70a70b9908b8b5b5d96912c80df4995e
SHA1 df79a089a93360dc921bcb950675a66a6922eb37
SHA512 7258d1867480cf24cd43765f33579f4a3b4159ea90db214f7f5dbaa851e1fb6fddabf57004125c9335736951cda27c1abaea77e17beeb5ab818709a0a6893e57
SSDEEP 49152:6yuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebby:+UjFqquuu6f9Aau1lZIUH0PgExyDbby
TLSH
T114D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.08.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 157958a325e17c00b18edd1bdfde1e4a419f436a695870ea262a512b411d34d9
MD5 df2338f09754a7c66ed1ea5dc0c4000d
SHA1 335e43d15e897db42a55f12561bca2b6ebce28ad
SHA512 8ca5139d0b2db2f6e1f853db8c59d671b8d75bcc50b1a5e729401453402d3b5fff21a97a147b8d9faa55570db391c2ca96c02b99f0e3823f0845b277688d2137
SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY7:DC/p+HuPOc4G
TLSH
T1E567181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW