www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-f9d1eaxt8m
SHA256 19767b296d9949048ff4f5076510264484b0e7b626ecdc34372451722216cad4
MD5 7eb751ed1e486002d76fc8e7ebb9d232
SHA1 66b621e6e6c226dc555227136ebe282cb9e79f67
SHA512 5a065854dafac7fda791bcd82ccfdef4f0b096a398d58c7bf6c386e41d215191cb9f0c73e5f5c1cd01b8e2920c8ba822b0c9f4216af0b66049be42da4c2e04a6
SSDEEP 49152:CELdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcw:9icypfByHqEJI5fixqBN7k0aa/waDP3
TLSH
T13ED5334B80ABE3C1DA768D370F206035B6A45EB478982DDCB5CA66C58931E7C48D7CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.10.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.10.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 19767b296d9949048ff4f5076510264484b0e7b626ecdc34372451722216cad4
MD5 7eb751ed1e486002d76fc8e7ebb9d232
SHA1 66b621e6e6c226dc555227136ebe282cb9e79f67
SHA512 5a065854dafac7fda791bcd82ccfdef4f0b096a398d58c7bf6c386e41d215191cb9f0c73e5f5c1cd01b8e2920c8ba822b0c9f4216af0b66049be42da4c2e04a6
SSDEEP 49152:CELdccyp/n/GYj0OOHhYNEJI5XvilQyqo/S9z/+Qxt/7klWaax9wvyDPcw:9icypfByHqEJI5fixqBN7k0aa/waDP3
TLSH
T13ED5334B80ABE3C1DA768D370F206035B6A45EB478982DDCB5CA66C58931E7C48D7CDB
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.10.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 d1cb5ba45116fe7ce6d0abe0c768c5e833775521b98d4b42428999f9667f78d0
MD5 1984c7183fe977c94c9cc7378dd5eedd
SHA1 9ff16bb3a1daf7f06ac3dcad636479ae6c3ead41
SHA512 dc1f39745d7157c952ccb6b2b2423a6054a5e60f74c09e2c8ef07d3ea89793809462c91104219592ff1be04ef2cb4840f0fbc83f58b517636b4c66e9d309e1f7
SSDEEP 196608:NZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY3:qC/p+HuPOc4K
TLSH
T15067181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW