www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 2.8MB
Sample261025-bf48aaez5l
SHA256 eea8f0bccb26d1b2b4d71adb532e423ad6a6a0d4c29a4daae09f645833ee8d40
MD5 db2374782adf7c5c460bf6412d9a1896
SHA1 af1b830406c164f98034e06aeca9b5034dd79634
SHA512 533448971d5d8dff126b660fd40c503b7b7d7da2fbc04dbd7e4ffcf4e00b50b2e528d704f4655df8d5bb0bd11605c489dcf65d3ee538c9b447dcfd0e4a99de2d
SSDEEP 49152:IyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbk:EUjFqquuu6f9Aau1lZIUH0PgExyDbbk
TLSH
T18FD5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.2.0.03.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 2.8MB
install.2.0.03.exe

.exe 30.5MB

www.mxh4h.com_sample.bin

SHA256 eea8f0bccb26d1b2b4d71adb532e423ad6a6a0d4c29a4daae09f645833ee8d40
MD5 db2374782adf7c5c460bf6412d9a1896
SHA1 af1b830406c164f98034e06aeca9b5034dd79634
SHA512 533448971d5d8dff126b660fd40c503b7b7d7da2fbc04dbd7e4ffcf4e00b50b2e528d704f4655df8d5bb0bd11605c489dcf65d3ee538c9b447dcfd0e4a99de2d
SSDEEP 49152:IyuU3b+sFqMZuuu6Wfvdq90G4ABrNu1lZIGNdKK0PQ0PgEx2TXixHJQkdebbk:EUjFqquuu6f9Aau1lZIUH0PgExyDbbk
TLSH
T18FD5331FE1DB0D84F9F42173718C2686FF016E8AFAD550ACF4B10926E7B3A1A5B84970
MD5 SHA1 SHA512 SSDEEP TLSH

install.2.0.03.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 935e0c166c1dbd12926e7d84d5471e2246206ff949f42d6d1f5a1ec0476e65e2
MD5 b6a89da9c93047a501709f261442a20c
SHA1 2ffd18e7891f0d734ff14f52d405fb09e894bce5
SHA512 cb447a10052bde4f25e66d22d42294785aafcd80695ead5208c18e046ac788f84198bebc8321f86f79f2e30e1796ca81ed53ef41e1db0774bba78dad1ba335b8
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYg:YC/p+HuPOc49
TLSH
T16467181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW