www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-kearqaef24
SHA256 fb325c599b1fa711aa89e2630d0dc45ab4b23c3ab6bb02c5158d6fef9ea5ee91
MD5 190310c996309f6abdfac0a7c71d0ce2
SHA1 66f608c6f68600a148d4e32a8b976281aa52407e
SHA512 4949e100ab5e47762001c6fa8f8fb6099b6220555606f3c1e41e7de30f7cd02c0974a60e0e5a5d5f9e5c519ac0f22f81d95ec9e56f6d63e57e04f7b20e3aa276
SSDEEP 49152:xQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWcO:xQu32Ky/KqjKRLz3hVV79pdrdGAqUA+a
TLSH
T13DD53397CAA71794FB3490F85F1AEB50FF36918E502A90485DA603C1887704E9F79AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.15.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.15.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 fb325c599b1fa711aa89e2630d0dc45ab4b23c3ab6bb02c5158d6fef9ea5ee91
MD5 190310c996309f6abdfac0a7c71d0ce2
SHA1 66f608c6f68600a148d4e32a8b976281aa52407e
SHA512 4949e100ab5e47762001c6fa8f8fb6099b6220555606f3c1e41e7de30f7cd02c0974a60e0e5a5d5f9e5c519ac0f22f81d95ec9e56f6d63e57e04f7b20e3aa276
SSDEEP 49152:xQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWcO:xQu32Ky/KqjKRLz3hVV79pdrdGAqUA+a
TLSH
T13DD53397CAA71794FB3490F85F1AEB50FF36918E502A90485DA603C1887704E9F79AF3
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.15.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 6a77bd11b9dbad66f7b59a9e0219118ba9d1b061246b03148516555fe6dabc8b
MD5 56a72922b0a56a69c74dcdbc12ef6b69
SHA1 dd5b926f62e042a51b8071cba6d94096ae2a3d72
SHA512 57141f3b9e7752412a754e4b9c63c08e54e28d33e160b75527d97aed749945092012e213edf1ebc4b761e5425063c76e9752b09c081190cd7325fdad95ae021d
SSDEEP 196608:FZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYb:yC/p+HuPOc4q
TLSH
T19767181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW