www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-md4drayv2r
SHA256 37e1fe4006103a5e175884e7570af7da6388cc98438a96b5b5513561455da0c8
MD5 80fb161f73306ad1fcd04c91bc9b0401
SHA1 38f14341e06a21e3c8efc0b9b4c8527807dde746
SHA512 92d874f94ed67099e2260563966425e1d583c7c0319c6aa2d19114437ca4811f447014b33397c7598dd62f40e953f2456330a9f87903664b5be351ccfd53ed82
SSDEEP 49152:YyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebby:UUjFqquuu6f9Aau1lZIUH0PgExyDbby
TLSH
T1C0D5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.03.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.03.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 37e1fe4006103a5e175884e7570af7da6388cc98438a96b5b5513561455da0c8
MD5 80fb161f73306ad1fcd04c91bc9b0401
SHA1 38f14341e06a21e3c8efc0b9b4c8527807dde746
SHA512 92d874f94ed67099e2260563966425e1d583c7c0319c6aa2d19114437ca4811f447014b33397c7598dd62f40e953f2456330a9f87903664b5be351ccfd53ed82
SSDEEP 49152:YyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebby:UUjFqquuu6f9Aau1lZIUH0PgExyDbby
TLSH
T1C0D5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.03.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 0f45eee7a56759b3e735bd9478a2de9f62de02b8c302b48dea03f466c7828df2
MD5 2bde57238e944c2595cbef35890b43b5
SHA1 26681238d5229d8c2809795610b7c26792db6204
SHA512 b3f1363d103edb1670bd54a774f6914207f9c9d0c496b15e5a9b73796f3165b83747d83d0349dbee17bf8b76be33ab6f09c6cab2ffb18224e6ff85c7af718691
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYF:YC/p+HuPOc44
TLSH
T10B67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW