www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-nlek2abv2l
SHA256 f4e96b2a898498e942e000c95fb44bcd1873bb16a979d4df250ebf7d468ccf5b
MD5 603ccc5a1ee81a41a5d91922fff5ccff
SHA1 8534e45dc3149179436e33cd6a6e413ffce76549
SHA512 f6b5b2a7c4e9ab2302bb8ab28962bc6b7a0d86ed7a9e649137b6f4b490396d0b959439c2bbd4f89fe54a55a81f1e4d6661a705cbebec3161893fbcecfec923bb
SSDEEP 49152:YQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWc7:YQu32Ky/KqjKRLz3hVV79pdrdGAqUA+/
TLSH
T134D53397CAA71794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.04.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.04.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 f4e96b2a898498e942e000c95fb44bcd1873bb16a979d4df250ebf7d468ccf5b
MD5 603ccc5a1ee81a41a5d91922fff5ccff
SHA1 8534e45dc3149179436e33cd6a6e413ffce76549
SHA512 f6b5b2a7c4e9ab2302bb8ab28962bc6b7a0d86ed7a9e649137b6f4b490396d0b959439c2bbd4f89fe54a55a81f1e4d6661a705cbebec3161893fbcecfec923bb
SSDEEP 49152:YQdk+gL00Zawjix/KqRzlKgWLbf3P3JVOup7BbpdrfC5izGAr8DhGqvPmHWc7:YQu32Ky/KqjKRLz3hVV79pdrdGAqUA+/
TLSH
T134D53397CAA71794FB3490F85F1AEB50FF36918E502A90485CA603C1887704E9F79AF3
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.04.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 89d2778afe65a6530d3ff38b98701c2914b45366b5fc1b5d9a58ad8400b24297
MD5 ad837a80dfca3d1358d35d6880219a76
SHA1 2f2e81b74ff62511ec5c39befd7500c9cc07c996
SHA512 ddd38377276d238c3f58c2af1648508f3b1639aa5d32e0206d8b2672c0ab9adfdff2c5982a73f96281881896b8453c8391973b3f069ae9691ee0e9ffbb359a08
SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYD:TC/p+HuPOc46
TLSH
T15167181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW