www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-hes7yssyft
SHA256 c4681af13fd4a00dcd35df5974f9635e0826f6c0d6a362f2993f743237144fa3
MD5 71df861e5d9cd3f62820abf502b23968
SHA1 d8f73f99e3db4f2d55ec7b6d77ef4d4a8e808752
SHA512 4f24ef4688e6c45d78431d78a54c0d41e73d7623cdfb24dcb40988659f71de1088abfa457f224481bc958568901d747e4e74d9687d615f21506f9206d98e2d25
SSDEEP 49152:YdcB+zKw8pG3d9mY/RJDXe86hd/u8/4RDiaHwxl8sBQL5tzuRB30gS2fdw+Mf:YCBEv8pUdUa3Xe86hd/GDuxl8sBccRVY
TLSH
T1C3D53390CA0FD61AF3199075062B30ABFBB962843C7765C84C7C129748A2CDD5FE9DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.12.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.12.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 c4681af13fd4a00dcd35df5974f9635e0826f6c0d6a362f2993f743237144fa3
MD5 71df861e5d9cd3f62820abf502b23968
SHA1 d8f73f99e3db4f2d55ec7b6d77ef4d4a8e808752
SHA512 4f24ef4688e6c45d78431d78a54c0d41e73d7623cdfb24dcb40988659f71de1088abfa457f224481bc958568901d747e4e74d9687d615f21506f9206d98e2d25
SSDEEP 49152:YdcB+zKw8pG3d9mY/RJDXe86hd/u8/4RDiaHwxl8sBQL5tzuRB30gS2fdw+Mf:YCBEv8pUdUa3Xe86hd/GDuxl8sBccRVY
TLSH
T1C3D53390CA0FD61AF3199075062B30ABFBB962843C7765C84C7C129748A2CDD5FE9DB9
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.12.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 e8b2ef11490d0377795a3da17dd4f8355f76fa1a4fda4cc5ccaf66854f2fc597
MD5 961744663b20ae53ce6af747877b0c0d
SHA1 60a1856c4b4903128960bda663c84f42267db5c5
SHA512 d49fdab3fee4ea8c3503e4265a770832197b25451fa2eef990bccfed4bf28f5cd2be0efba8e0834006d4e6146b125309bf3582fc1e88d973ebc21d3d663c7382
SSDEEP 196608:PZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYA:8C/p+HuPOc49
TLSH
T13667181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW