e7591ce563b746b2c1d5f7466100cdf6eca6a5b18ef9bf3af307109ec8d9d804

Sharing

Copy URL Twitter E-mail

General

Target
e7591ce563b746b2c1d5f7466100cdf6eca6a5b18ef9bf3af307109ec8d9d804
Size 11.4MB
Sample261027-x83e2sed38
SHA256 e7591ce563b746b2c1d5f7466100cdf6eca6a5b18ef9bf3af307109ec8d9d804
MD5 d44fd13fb11e99b04db300a495985567
SHA1 047a3e5ecfdcb20a27e0ede8a1c9475d6d979e69
SHA512 eb9c87c20557031ea5c07cbcb3997ea59af5293ed19ec0ed4e10799cc2869cde8a53eaa20824dda50ab5f29a6313cd3dabd47e5281f0af9da6ae38185373e563
SSDEEP 196608:kbWPHZbtcgwOPHZbtcgwOPHZbtcgwOPHZbtcgwOPHZbtcgwOPHZbtcgw:FPHZtPHZtPHZtPHZtPHZtPHZ
TLSH
T14BC6F131D58259F8FC89C5F604193E8329F6A96D6BE04ED5323C5E38BB46F843A349D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e7591ce563b746b2c1d5f7466100cdf6eca6a5b18ef9bf3af307109ec8d9d804

File Explorer

e7591ce563b746b2c1d5f7466100cdf6eca6a5b18ef9bf3af307109ec8d9d804

.exe 11.4MB

e7591ce563b746b2c1d5f7466100cdf6eca6a5b18ef9bf3af307109ec8d9d804

IMPHASH ab86015899302db1c21e2427f0e32594
SHA256 e7591ce563b746b2c1d5f7466100cdf6eca6a5b18ef9bf3af307109ec8d9d804
MD5 d44fd13fb11e99b04db300a495985567
SHA1 047a3e5ecfdcb20a27e0ede8a1c9475d6d979e69
SHA512 eb9c87c20557031ea5c07cbcb3997ea59af5293ed19ec0ed4e10799cc2869cde8a53eaa20824dda50ab5f29a6313cd3dabd47e5281f0af9da6ae38185373e563
SSDEEP 196608:kbWPHZbtcgwOPHZbtcgwOPHZbtcgwOPHZbtcgwOPHZbtcgwOPHZbtcgw:FPHZtPHZtPHZtPHZtPHZtPHZ
TLSH
T14BC6F131D58259F8FC89C5F604193E8329F6A96D6BE04ED5323C5E38BB46F843A349D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

174800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipGetImageEncodersSize GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipGetImageEncoders GdipAlloc GdipCreateBitmapFromHBITMAP

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash

kernel32

CreateMutexW LocalFree GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId CreateDirectoryW CreateFileW WriteFile GetTempPathW CloseHandle GetLastError GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GetEnvironmentVariableW GetCurrentDirectoryW DeleteFileW FileTimeToLocalFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx GetLogicalDriveStringsW ReadFile RemoveDirectoryW SetHandleInformation PeekNamedPipe WaitForSingleObject GetCurrentProcessId TerminateProcess OpenProcess GetLocalTime GetTickCount64 GetModuleFileNameW GetPrivateProfileStringW CopyFileW MoveFileW GetComputerNameW FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessMemoryInfo Sleep

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

msvcp140

?_Xbad_function_call@std@@YAXXZ _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Query_perf_frequency _Xtime_get_ticks ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

winhttp

WinHttpQueryHeaders

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy memcpy memmove memset wcschr wcsrchr memcmp __C_specific_handler __current_exception __current_exception_context __std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_set_app_type terminate _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _crt_atexit _cexit _c_exit _register_thread_local_exe_atexit_callback _beginthreadex _invoke_watson _seh_filter_exe _initialize_onexit_table _register_onexit_function

api-ms-win-crt-string-l1-1-0

towlower iswspace wcslen wcscmp wcscat_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s _set_fmode __p__commode __stdio_common_vsnprintf_s

api-ms-win-crt-convert-l1-1-0

wcstol wcstoul _wtoi

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

e7591ce563b746b2c1d5f7466100cdf6eca6a5b18ef9bf3af307109ec8d9d804

gdiplus

bcrypt

kernel32

shell32

ole32

oleaut32

msvcp140

winhttp

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic