www[.]mxh4h[.]com_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
www.mxh4h.com_sample.bin
Size 3.9MB
Sample261025-hce8baes61
SHA256 29241ee0a1063cbbb4d7a2fd3a5cf75ca79731dbf9bcd5459314472397754224
MD5 829035b5b2338edf3add383231b8c2e5
SHA1 09e099126e5c6fa850ea7d7e1d3d3564932f9a89
SHA512 5c9b1d63a095181335a9b7a1854faec5b8642b951e6c8c404dc2a0a6e5a96e0016574138d7d4b20b01a9c4f597e2a1c587c2bbbd2359a5a38839b76a4054028b
SSDEEP 98304:dzrY+fEcj7gSPWHAN/ru0sXQqEEl7+e7jPCqMMwKAJk3b5Lt:B7Ecf7/rjsXQqEy7+evqMwhWlLt
TLSH
T1ED16335B846D9F66C5EE867461B82D1B3626C6B81FC78D21ECF46F850CC1BADB8C18C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/install.3.1.10.exe

File Explorer

www.mxh4h.com_sample.bin

.zip 3.9MB
install.3.1.10.exe

.exe 36.9MB

www.mxh4h.com_sample.bin

SHA256 29241ee0a1063cbbb4d7a2fd3a5cf75ca79731dbf9bcd5459314472397754224
MD5 829035b5b2338edf3add383231b8c2e5
SHA1 09e099126e5c6fa850ea7d7e1d3d3564932f9a89
SHA512 5c9b1d63a095181335a9b7a1854faec5b8642b951e6c8c404dc2a0a6e5a96e0016574138d7d4b20b01a9c4f597e2a1c587c2bbbd2359a5a38839b76a4054028b
SSDEEP 98304:dzrY+fEcj7gSPWHAN/ru0sXQqEEl7+e7jPCqMMwKAJk3b5Lt:B7Ecf7/rjsXQqEy7+evqMwhWlLt
TLSH
T1ED16335B846D9F66C5EE867461B82D1B3626C6B81FC78D21ECF46F850CC1BADB8C18C1
MD5 SHA1 SHA512 SSDEEP TLSH

install.3.1.10.exe

IMPHASH a6a6ee3ce2319cb569a489c278731d92
SHA256 3a71f219c94079b939ceaf43cd14518d6277cd3acaf12e1eabf74649d3120f8c
MD5 b4ebc76202d5d72c91bc78b16d2e9d09
SHA1 553a5069077e591cf29ac3be43a77199e66d52ba
SHA512 fa89434dd7e8b1997985c0c14ce7f9a05af98ebe67d04b92806a106ea4a7a46029f07c9392685c3bbcb6d2e3d01c8d789315f344397b2ca0dcdbef4cdd33a5aa
SSDEEP 98304:PMUii14Casj3pLfMr7S5OY/Y8ohkHMlaELk9:PMo14Cj3xfMr7ichmMlHLk9
TLSH
T156879112B741899EE4755234488B8F81E732ECB286B1973733B8772E1FFA34C5E9A544
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx VirtualAlloc TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW