fee854a8b8f7a9a063d99b2a69aca6d87c30e65d3c6ef57ee3ec3db01e472ca6[.]exe

General

Target
fee854a8b8f7a9a063d99b2a69aca6d87c30e65d3c6ef57ee3ec3db01e472ca6.exe
Size 318KB
Sample261030-leabmaa15x
SHA256 fee854a8b8f7a9a063d99b2a69aca6d87c30e65d3c6ef57ee3ec3db01e472ca6
MD5 6ceef84ce3eba87e7f22629fdbfbeb81
SHA1 5d2f747629a2a2a4ba5b61fdf97faf298b1e967c
SHA512 6fb53dc7cf94871455c6203cd5b40bc0993fecdaa3d0cc402ec619657d23c0484c79e85425369961a77fe8d5f88cbe5624185b1846d1e0a175e6cbad5b03802e
SSDEEP 3072:BlyOmwDWGkeI4UcPePZenrOjaQJ51zMLpUYJgD8yZHBOxH4HReoM8IhFGk:BF0GpIbPiQJ5xM1JNyZ4xH4HRef8I/9
TLSH
T1CD649E6BE6360ED7C4FBC13D89639539B920782DC33ACED73245935A2B62BD45978380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
fee854a8b8f7a9a063d99b2a69aca6d87c30e65d3c6ef57ee3ec3db01e472ca6.exe

File Explorer

fee854a8b8f7a9a063d99b2a69aca6d87c30e65d3c6ef57ee3ec3db01e472ca6.exe

.dll 318KB

fee854a8b8f7a9a063d99b2a69aca6d87c30e65d3c6ef57ee3ec3db01e472ca6.exe

IMPHASH 739c850ed96273dd9171b0979123c8f3
SHA256 fee854a8b8f7a9a063d99b2a69aca6d87c30e65d3c6ef57ee3ec3db01e472ca6
MD5 6ceef84ce3eba87e7f22629fdbfbeb81
SHA1 5d2f747629a2a2a4ba5b61fdf97faf298b1e967c
SHA512 6fb53dc7cf94871455c6203cd5b40bc0993fecdaa3d0cc402ec619657d23c0484c79e85425369961a77fe8d5f88cbe5624185b1846d1e0a175e6cbad5b03802e
SSDEEP 3072:BlyOmwDWGkeI4UcPePZenrOjaQJ51zMLpUYJgD8yZHBOxH4HReoM8IhFGk:BF0GpIbPiQJ5xM1JNyZ4xH4HRef8I/9
TLSH
T1CD649E6BE6360ED7C4FBC13D89639539B920782DC33ACED73245935A2B62BD45978380
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d2:75:93:f0:b0:78:ec:17:3a:52:3c:91:d7:65:31:8f

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Lbh-ssy-CA v1.01

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

6

Entry point

291216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

IsDebuggerPresent RaiseException Sleep GetCurrentProcess ExitProcess GetTickCount64 VirtualAlloc VirtualProtect GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryW lstrcatW lstrlenW WideCharToMultiByte GetModuleHandleExW FreeLibrary EncodePointer InterlockedFlushSList VirtualQuery RtlUnwindEx InitializeSListHead GetCurrentProcessId TerminateProcess IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleHandleW GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx GetCurrentThreadId InitializeCriticalSectionEx

user32

MessageBoxA

ole32

CoGetObjectContext CoInitializeEx

msvcrt

_msize __getmainargs __CppXcptFilter ?terminate@@YAXXZ _errno strcpy_s _initterm_e _initterm _callnewh abort _beginthreadex rewind ftell fseek fread fopen fclose rand malloc free _setjmp _local_unwind __DestructExceptionObject _amsg_exit __C_specific_handler memset memmove _CxxThrowException longjmp memcpy realloc __CxxFrameHandler3

Name

.text

Size

147KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.stub

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fee854a8b8f7a9a063d99b2a69aca6d87c30e65d3c6ef57ee3ec3db01e472ca6.exe

PE Signature issue

kernel32

user32

ole32

msvcrt

generic