www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261024-s87mjsax61
SHA256 4d1ce46bf7794426ae29173cbd8787552f9bd57dbece850ecc0195d5fe391da0
MD5 91db78cf5a89cd7371136613c3d07d30
SHA1 1e2ad31c74abd79406d2ac4ab1aa04c9c826c326
SHA512 5a1560630beeec43cd82f000c01b570939993a15386e956998b0fc71600664907c96ce01683bb60a08cbeb58c2c4cc49537b91af9fcf56acb88bee752031e57d
SSDEEP 49152:8yuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbu:wUjFqquuu6f9Aau1lZIUH0PgExyDbbu
TLSH
T133D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.07.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.07.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 4d1ce46bf7794426ae29173cbd8787552f9bd57dbece850ecc0195d5fe391da0
MD5 91db78cf5a89cd7371136613c3d07d30
SHA1 1e2ad31c74abd79406d2ac4ab1aa04c9c826c326
SHA512 5a1560630beeec43cd82f000c01b570939993a15386e956998b0fc71600664907c96ce01683bb60a08cbeb58c2c4cc49537b91af9fcf56acb88bee752031e57d
SSDEEP 49152:8yuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbu:wUjFqquuu6f9Aau1lZIUH0PgExyDbbu
TLSH
T133D5331FE1DB0D84F9F42172718C2686FF016E8AFAD550ACF4F10966E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.07.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 d7c5a430b7cdd0f4f068d537082bf63e8d1da374e6de607677617e240dcd89e5
MD5 a8ee7ca0b8f5abdbabbc22d7838260ca
SHA1 e261c29817829bef65916c6b6ed47742532b3ff5
SHA512 284fe69cf0e0ffe76742de4112be66c98c4d62a8ec86b456b043b7da07a55a3f07573f02806bae56b0d0baaacfbce7814ebf3cd1b8ad3944856edb0c4e714b8c
SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYD:4C/p+HuPOc4+
TLSH
T1ED67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW