69a0c89a1f4b2805dfd85b003674186169afd29d9021245a44630ebfbf3708ca[.]bin

General

Target
69a0c89a1f4b2805dfd85b003674186169afd29d9021245a44630ebfbf3708ca.bin
Size 1.2MB
Sample261027-a7yddaav5m
SHA256 69a0c89a1f4b2805dfd85b003674186169afd29d9021245a44630ebfbf3708ca
MD5 7ebe41a4716d132500b076c6e8aed7fe
SHA1 1919a5d4c3b2d8b8ae8509eece94be1c6d6df8df
SHA512 a8d86192d1b17aec228fe8fba1f3d2dbb97c5e56a76f0431562582694d6791140f36e0824ef906cf2b020833306bd3972756f8bc2b4a86e570f2b827a146dc1d
SSDEEP 24576:CP1sWuKAT3sPwwXWi2UF/bGORsLu1Un2exfMmGcYN:61sW0TeB/3RsLtfx
TLSH
T12845DFEDF25E06A7C8A9E9FE8F756960CA6D3B031BD014FB464832050E217E44E357A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69a0c89a1f4b2805dfd85b003674186169afd29d9021245a44630ebfbf3708ca.bin

File Explorer

69a0c89a1f4b2805dfd85b003674186169afd29d9021245a44630ebfbf3708ca.bin

.exe 1.2MB

69a0c89a1f4b2805dfd85b003674186169afd29d9021245a44630ebfbf3708ca.bin

IMPHASH 68ebcb3a5285e63de36bcc6d3ce466be
SHA256 69a0c89a1f4b2805dfd85b003674186169afd29d9021245a44630ebfbf3708ca
MD5 7ebe41a4716d132500b076c6e8aed7fe
SHA1 1919a5d4c3b2d8b8ae8509eece94be1c6d6df8df
SHA512 a8d86192d1b17aec228fe8fba1f3d2dbb97c5e56a76f0431562582694d6791140f36e0824ef906cf2b020833306bd3972756f8bc2b4a86e570f2b827a146dc1d
SSDEEP 24576:CP1sWuKAT3sPwwXWi2UF/bGORsLu1Un2exfMmGcYN:61sW0TeB/3RsLtfx
TLSH
T12845DFEDF25E06A7C8A9E9FE8F756960CA6D3B031BD014FB464832050E217E44E357A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

98800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stesheal.pdb

kernel32

CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetTickCount64 GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter SystemTimeToFileTime TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

user32

GetClassNameW GetCursorPos GetDoubleClickTime GetFocus GetForegroundWindow GetSystemMetrics IsWindowVisible ScreenToClient SystemParametersInfoW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile

Name

.text

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

450KB

Virtual Size

449KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

351KB

Virtual Size

353KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

361B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

69a0c89a1f4b2805dfd85b003674186169afd29d9021245a44630ebfbf3708ca.bin

kernel32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic