EmergencyShutdown_x86[.]exe

General

Target
EmergencyShutdown_x86.exe
Size 212KB
Sample261026-3vm14aas3k
SHA256 27472342e1f926a5dcc377ead7368bc8d3a389b70fe2cb1c3c2e63bb96f246ad
MD5 da5d576a9bae2733f7e1f2dd241dfdbc
SHA1 5eaef859e2e336741bd64b018b1882f47725025c
SHA512 5be7df9f56847825fa51b581a7754765747239ddbdc52bad91a7dd0c3d502a1a7e24372f4268a7f3bb2304b41d570a75577acbb065d5335645b2cd6076f6ebbd
SSDEEP 3072:FnMR21f3rzUUhRzR58iNradK8+sU3Fs3LZpJ8j1/4k0uXMHY5tLVsTZgtG7q:FMR21fBViNd+soGLZ38+jEJGe
TLSH
T1C8247D12B991C033D56719358DF4CB799E3EFC610F61A9CBA7840FBA8E306D19B3560A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EmergencyShutdown_x86.exe

File Explorer

EmergencyShutdown_x86.exe

.exe 212KB

EmergencyShutdown_x86.exe

IMPHASH 59805051550c60c21104633d856514e3
SHA256 27472342e1f926a5dcc377ead7368bc8d3a389b70fe2cb1c3c2e63bb96f246ad
MD5 da5d576a9bae2733f7e1f2dd241dfdbc
SHA1 5eaef859e2e336741bd64b018b1882f47725025c
SHA512 5be7df9f56847825fa51b581a7754765747239ddbdc52bad91a7dd0c3d502a1a7e24372f4268a7f3bb2304b41d570a75577acbb065d5335645b2cd6076f6ebbd
SSDEEP 3072:FnMR21f3rzUUhRzR58iNradK8+sU3Fs3LZpJ8j1/4k0uXMHY5tLVsTZgtG7q:FMR21fBViNd+soGLZ38+jEJGe
TLSH
T1C8247D12B991C033D56719358DF4CB799E3EFC610F61A9CBA7840FBA8E306D19B3560A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetModuleHandleW CreateFileW GetLastError FormatMessageW LocalFree GetProcAddress GetCurrentProcess MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW WideCharToMultiByte Sleep GetCurrentThreadId InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap ReadConsoleW HeapSize WriteConsoleW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Sharing