nQ10jYwFnDsj[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nQ10jYwFnDsj.exe
Size 1.4MB
Sample261030-blhapsgt71
SHA256 d16f4df6d0a0b0993748bd01ffd6f4ef8bdf1a57399f4310583986b9fbf0be40
MD5 025c9c1d81a59636b571bdeb5771e88b
SHA1 1699b594612cb29084c10117dc17762ee94c2f78
SHA512 06fda7f365306f717cf328d56f4be0c8ee5f3752dc09d2d2dcaabdf225bed13e7a02478543aedb01cec47ea39d8d59a85939515066dadc37e951ec3c95c93139
SSDEEP 24576:iJgvkMzSYAM9YSlbczEpQizftQDc06WogeOfQr0W:itMzLAVStcdiTgFoR2A0W
TLSH
T1CC65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nQ10jYwFnDsj.exe

File Explorer

nQ10jYwFnDsj.exe

.exe 1.4MB

nQ10jYwFnDsj.exe

IMPHASH a98fcc30097a9893402b8be27c43a74b
SHA256 d16f4df6d0a0b0993748bd01ffd6f4ef8bdf1a57399f4310583986b9fbf0be40
MD5 025c9c1d81a59636b571bdeb5771e88b
SHA1 1699b594612cb29084c10117dc17762ee94c2f78
SHA512 06fda7f365306f717cf328d56f4be0c8ee5f3752dc09d2d2dcaabdf225bed13e7a02478543aedb01cec47ea39d8d59a85939515066dadc37e951ec3c95c93139
SSDEEP 24576:iJgvkMzSYAM9YSlbczEpQizftQDc06WogeOfQr0W:itMzLAVStcdiTgFoR2A0W
TLSH
T1CC65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

508308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx9_43

D3DXMatrixTranspose

dwmapi

DwmExtendFrameIntoClientArea

user32

FindWindowA GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DispatchMessageA LoadCursorA SetWindowPos ShowWindow GetAsyncKeyState SetWindowLongA GetForegroundWindow MoveWindow DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage LoadIconA PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow GetWindowThreadProcessId GetWindowRect

kernel32

HeapReAlloc CreateProcessW GetExitCodeProcess WaitForSingleObject ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW ExitProcess ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind LoadLibraryExW TlsFree TlsSetValue WriteProcessMemory ReadProcessMemory GetModuleFileNameA SetConsoleTitleA GetCurrentProcess GetTickCount64 K32GetModuleBaseNameA Process32First Module32Next Module32First OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle VirtualProtectEx GetModuleHandleA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW IsValidCodePage AreFileApisANSI GetLastError GetModuleHandleW MoveFileExW GetFileInformationByHandleEx LocalFree FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx Sleep GetCurrentThreadId FlsAlloc FlsGetValue FlsSetValue FlsFree SetEndOfFile InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead TlsGetValue GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetEnvironmentVariableW SetStdHandle HeapSize WriteConsoleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmAssociateContextEx ImmGetContext

d3dcompiler_43

D3DCompile

Name

.text

Size

701KB

Virtual Size

701KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

649KB

Virtual Size

648KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

nQ10jYwFnDsj.exe

d3d11

d3dx9_43

dwmapi

user32

kernel32

imm32

d3dcompiler_43

generic