www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-n2zadayy2r
SHA256 501d7a2bfc456b0e7ebcca6af1a76690e2d37f957013b4f7483f049d5bd79bac
MD5 427a7b40fbf42ee3a4e29536d28d88ec
SHA1 effc5acbb33f1270c7cb2cf4309a52a3cb7a072c
SHA512 a689a2b13ae7ae84ce1d87f1e757c0ea66d03f5335927a468b82f8cc5af031502ce0e9094d640b856f6460a120afb615249bd9c841cad62e7ccc3a7564976b60
SSDEEP 49152:z/8gA+fqXIBLq3+mX0BKKVmKsBLaJ8K1KtQ+BvrH3GPALKzT:RA+fqGO3+mXOKBrB5tNB7GPAS
TLSH
T1A6D5331099E9C396F5379AB6B7B00589FB05F98B658E3210C7B5670A4B2307F73B049D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.05.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.05.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 501d7a2bfc456b0e7ebcca6af1a76690e2d37f957013b4f7483f049d5bd79bac
MD5 427a7b40fbf42ee3a4e29536d28d88ec
SHA1 effc5acbb33f1270c7cb2cf4309a52a3cb7a072c
SHA512 a689a2b13ae7ae84ce1d87f1e757c0ea66d03f5335927a468b82f8cc5af031502ce0e9094d640b856f6460a120afb615249bd9c841cad62e7ccc3a7564976b60
SSDEEP 49152:z/8gA+fqXIBLq3+mX0BKKVmKsBLaJ8K1KtQ+BvrH3GPALKzT:RA+fqGO3+mXOKBrB5tNB7GPAS
TLSH
T1A6D5331099E9C396F5379AB6B7B00589FB05F98B658E3210C7B5670A4B2307F73B049D
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.05.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 734a0cf28012a73b7088e73e5bbd9c3e6296bdd9dba3e3fe1a6fe4cc0419ec3f
MD5 79188aa515e8493d206b78ec78e6beb6
SHA1 977d79c7985b5255a9b2badc56aca5a08903ff55
SHA512 0a786640d318cee08bded6b2f7cf098b8999b10ec06a28a1475bce595216e25850ea12f4194f72710569f153261a8b30caee35cb4bc7efe9a2af48cd0d1d084e
SSDEEP 196608:GZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYn:FC/p+HuPOc4e
TLSH
T12A67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW