f7a94508252e01cf555da011b19cb63f8ebb1259ecafd83a093a52a40ef2bd5a[.]exe

General

Target
f7a94508252e01cf555da011b19cb63f8ebb1259ecafd83a093a52a40ef2bd5a.exe
Size 738KB
Sample261030-df2hhavxdv
SHA256 f7a94508252e01cf555da011b19cb63f8ebb1259ecafd83a093a52a40ef2bd5a
MD5 e44a42a394092af2d4365f5a0b162466
SHA1 5b0e12725dbf751aee21792751dade2776337343
SHA512 0fd603ddf8b1539ebb3ac146ec61cceb40872c60771f6d8eb4f5102878536767b102097d4656516b111d8f728e0664bed20e56ab4b8b32a2e32559363f9b186c
SSDEEP 12288:bAorGDWhzUXXZHMwVI1Kag3EUT+EM8tjX7JbWlsj8gR5Ub0XGk5Vfh9:bAMcZH5VUKHEUBjX7pDj8yUevfh9
TLSH
T1D6F41296FAAA46FDC43A823949174A11E6B57C000B6467FF13C4E3392E67BE4473EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f7a94508252e01cf555da011b19cb63f8ebb1259ecafd83a093a52a40ef2bd5a.exe

File Explorer

f7a94508252e01cf555da011b19cb63f8ebb1259ecafd83a093a52a40ef2bd5a.exe

.dll 738KB

f7a94508252e01cf555da011b19cb63f8ebb1259ecafd83a093a52a40ef2bd5a.exe

IMPHASH ef853c49cd5a4adaa84f16987caf1659
SHA256 f7a94508252e01cf555da011b19cb63f8ebb1259ecafd83a093a52a40ef2bd5a
MD5 e44a42a394092af2d4365f5a0b162466
SHA1 5b0e12725dbf751aee21792751dade2776337343
SHA512 0fd603ddf8b1539ebb3ac146ec61cceb40872c60771f6d8eb4f5102878536767b102097d4656516b111d8f728e0664bed20e56ab4b8b32a2e32559363f9b186c
SSDEEP 12288:bAorGDWhzUXXZHMwVI1Kag3EUT+EM8tjX7JbWlsj8gR5Ub0XGk5Vfh9:bAMcZH5VUKHEUBjX7pDj8yUevfh9
TLSH
T1D6F41296FAAA46FDC43A823949174A11E6B57C000B6467FF13C4E3392E67BE4473EB41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

47328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kaglok.pdb

kernel32

CloseHandle CompareStringOrdinal CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesW GetFileType GetLargePageMinimum GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetNumberOfConsoleInputEvents GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GetSystemTimes GetTempPathW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile

user32

GetActiveWindow GetDoubleClickTime GetFocus GetForegroundWindow GetKeyboardType GetSystemMetrics SystemParametersInfoW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

Name

.text

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

322KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

308KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

161B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f7a94508252e01cf555da011b19cb63f8ebb1259ecafd83a093a52a40ef2bd5a.exe

kernel32

user32

api-ms-win-core-synch-l1-2-0

generic