U674U94Y9W5Z4JJ6[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
U674U94Y9W5Z4JJ6.exe
Size 26.4MB
Sample261030-2h95esstfx
SHA256 ed84181c0281a710a5f4be1d4ca882366bd7e7b92e570b5ce4440b7a4f956b1d
MD5 bf80702ea0c2aca9f7a994ec619b34d1
SHA1 b061efaf7a23c6678303e2f8e99e461788ba87b1
SHA512 58318847367c1434d313a007ecf4fb505e5ecfab05b880c3dca15c59a6037a9d1a988e8457ee4471f4407f0a3c612b2987b3719ce949cca6ed8507104131aa2e
SSDEEP 786432:/o5Icn9mKF4ZM98ekhx+kxFwEKNx+XmDGp:g5b9my4ZMIjQsqGp
TLSH
T1AF57339547C457DCEFC29D20B04E336EB4C17D3B5DA9A92936C92802BB70CEA5085EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
U674U94Y9W5Z4JJ6.exe

File Explorer

U674U94Y9W5Z4JJ6.exe

.exe 26.4MB

U674U94Y9W5Z4JJ6.exe

IMPHASH 0eb253f5445017d20c15d95798b2ec43
SHA256 ed84181c0281a710a5f4be1d4ca882366bd7e7b92e570b5ce4440b7a4f956b1d
MD5 bf80702ea0c2aca9f7a994ec619b34d1
SHA1 b061efaf7a23c6678303e2f8e99e461788ba87b1
SHA512 58318847367c1434d313a007ecf4fb505e5ecfab05b880c3dca15c59a6037a9d1a988e8457ee4471f4407f0a3c612b2987b3719ce949cca6ed8507104131aa2e
SSDEEP 786432:/o5Icn9mKF4ZM98ekhx+kxFwEKNx+XmDGp:g5b9my4ZMIjQsqGp
TLSH
T1AF57339547C457DCEFC29D20B04E336EB4C17D3B5DA9A92936C92802BB70CEA5085EB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25834350

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

dwrite

DWriteCreateFactory

dcomp

DCompositionCreateDevice

dxgi

CreateDXGIFactory1

dwmapi

DwmSetWindowAttribute

user32

SetWindowLongPtrW IsClipboardFormatAvailable GetClipboardData ShowWindow SetForegroundWindow MessageBoxW FindWindowW TrackMouseEvent TranslateMessage DispatchMessageW PeekMessageW PostMessageW WaitMessage DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IsWindow DestroyWindow SetWindowPos SetCapture ReleaseCapture GetWindowRect GetCursorPos ScreenToClient GetWindowLongPtrW GetKeyState LoadCursorW MonitorFromPoint GetMonitorInfoW GetDpiForWindow SetProcessDpiAwarenessContext EnumDisplayDevicesW GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo GetRawInputDeviceInfoW GetRawInputDeviceList IsWindowVisible GetWindowTextW EnumWindows GetWindowThreadProcessId ExitWindowsEx CloseClipboard OpenClipboard

shell32

ShellExecuteW CommandLineToArgvW

ole32

CoCreateInstance PropVariantClear CoCreateGuid CoTaskMemFree CoInitializeEx

winhttp

WinHttpQueryHeaders WinHttpCrackUrl WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpOpen WinHttpCloseHandle WinHttpSetTimeouts WinHttpSetOption WinHttpConnect WinHttpQueryDataAvailable WinHttpReadData

bcrypt

BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptGenRandom

crypt32

CryptVerifyCertificateSignatureEx CertFreeCertificateContext CertCompareCertificateName

wintrust

CryptCATAdminAcquireContext2 CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain CryptCATAdminCalcHashFromFileHandle2 WinVerifyTrust

advapi32

RegCloseKey OpenProcessToken GetTokenInformation ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx OpenThreadToken SetThreadToken RegGetValueW RegSetValueExW RegDeleteValueW RegCreateKeyExW AdjustTokenPrivileges LookupAccountNameW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW LookupPrivilegeValueW GetCurrentHwProfileW GetUserNameW

iphlpapi

GetIfTable2 FreeMibTable GetAdaptersInfo GetAdaptersAddresses

ws2_32

recvfrom ntohl htonl closesocket inet_ntop sendto setsockopt WSAStartup WSACleanup getaddrinfo freeaddrinfo socket

fwpuclnt

FwpmFilterDestroyEnumHandle0 FwpmEngineOpen0 FwpmFreeMemory0 FwpmEngineClose0 FwpmFilterCreateEnumHandle0 FwpmFilterEnum0 FwpmFilterAdd0

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW

ncrypt

NCryptOpenStorageProvider NCryptGetProperty NCryptFreeObject

powrprof

PowerDeterminePlatformRoleEx

kernel32

HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter HeapAlloc SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileType VirtualProtect LoadLibraryExW GlobalLock GlobalUnlock OutputDebugStringA K32GetDeviceDriverFileNameW K32EnumDeviceDrivers SetThreadPriority SetLastError QueryDosDeviceW GetFileSizeEx Module32NextW Module32FirstW Process32NextW LCMapStringW Process32FirstW CreateToolhelp32Snapshot VirtualFree VirtualAlloc GetTickCount GetThreadContext CreateProcessA GetCurrentThread CreateThread CheckRemoteDebuggerPresent FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc WriteConsoleW LockResource IsDebuggerPresent GetFileAttributesW GetUserDefaultLocaleName WideCharToMultiByte GetSystemPowerStatus GetTimeZoneInformation GetComputerNameW GetFirmwareType GetFirmwareEnvironmentVariableW GetPhysicallyInstalledSystemMemory GetSystemFirmwareTable EnumSystemFirmwareTables GetNativeSystemInfo GetLogicalProcessorInformationEx GetComputerNameExW GetWindowsDirectoryW GetSystemDirectoryW GlobalMemoryStatusEx DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumeInformationW GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW MoveFileExW CopyFileW QueryFullProcessImageNameW GetModuleFileNameW OpenProcess Sleep OpenEventW CreateEventW SetEvent SetFilePointerEx GetLastError CreateMutexW ExitProcess QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleW LoadResource SizeofResource FindResourceW FreeLibrary GetProcAddress LoadLibraryW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW ReadFile RemoveDirectoryW SetFileInformationByHandle WriteFile GetTempPathW CloseHandle SetHandleInformation CreatePipe PeekNamedPipe GetProcessTimes GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess ResumeThread CreateProcessW GetTickCount64 LocalFree GetFileInformationByHandleEx WaitForSingleObject MultiByteToWideChar GetCommandLineW FlushFileBuffers

comctl32

ord345

d3dcompiler_47

D3DCompile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

Name

.text

Size

Virtual Size

643KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.YOK

Size

Virtual Size

22.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

."[z

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.E7c

Size

26.4MB

Virtual Size

26.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

U674U94Y9W5Z4JJ6.exe

d3d11

dwrite

dcomp

dxgi

dwmapi

user32

shell32

ole32

winhttp

bcrypt

crypt32

wintrust

advapi32

iphlpapi

ws2_32

fwpuclnt

setupapi

ncrypt

powrprof

kernel32

comctl32

d3dcompiler_47

api-ms-win-core-synch-l1-2-0

generic