71d7190d5c5ff8ed[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
71d7190d5c5ff8ed.exe
Size 5.8MB
Sample261030-nsejlsed33
SHA256 71d7190d5c5ff8edbbec0904fd47d863d0dfb8cec15b4401886522338e4f709f
MD5 4702ba86efe182fb015e8d16b2074364
SHA1 21efdd9f4ce0c9f26b5bf0ca50b44afc8052c0cb
SHA512 1cea80eb8558cfef085fead4cccb54e4604dbc16becaceade4316508a7d15a382e8eb8decd7e507dfd8c74f95b47ff56f484989dc2a9b9867c8a926587b0e792
SSDEEP 98304:T95zBJMTHDe8Lgpt0MFDiCs9oZNCy7ulTexuwkears:R5KH2ZNCsuw0aar
TLSH
T179566B43F36290F8C52AC135935A6233FA227C490B3579EB5BE48B253E65F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71d7190d5c5ff8ed.exe

File Explorer

71d7190d5c5ff8ed.exe

.exe 5.8MB

71d7190d5c5ff8ed.exe

IMPHASH 28864f2b9dc62695123694388d913325
SHA256 71d7190d5c5ff8edbbec0904fd47d863d0dfb8cec15b4401886522338e4f709f
MD5 4702ba86efe182fb015e8d16b2074364
SHA1 21efdd9f4ce0c9f26b5bf0ca50b44afc8052c0cb
SHA512 1cea80eb8558cfef085fead4cccb54e4604dbc16becaceade4316508a7d15a382e8eb8decd7e507dfd8c74f95b47ff56f484989dc2a9b9867c8a926587b0e792
SSDEEP 98304:T95zBJMTHDe8Lgpt0MFDiCs9oZNCy7ulTexuwkears:R5KH2ZNCsuw0aar
TLSH
T179566B43F36290F8C52AC135935A6233FA227C490B3579EB5BE48B253E65F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3986896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

clicky_pet.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCancelIoFileEx NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CreateDirectoryW CreateFileW CreateIoCompletionPort CreateMutexA CreateMutexW CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeviceIoControl DuplicateHandle EncodePointer ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetUserDefaultUILanguage GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber LCIDToLocaleName LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW MultiByteToWideChar OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFileEx ReleaseMutex ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFileEx lstrlenW

user32

AdjustWindowRect AdjustWindowRectEx AllowSetForegroundWindow AppendMenuW ChangeDisplaySettingsExW ChangeWindowMessageFilterEx CheckMenuItem ClientToScreen ClipCursor CloseTouchInputHandle CreateAcceleratorTableW CreateIcon CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawIconEx DrawMenuBar DrawTextW EnableMenuItem EnableWindow EnumChildWindows EnumDisplayMonitors FillRect FindWindowExW FindWindowW FlashWindowEx GetActiveWindow GetAsyncKeyState GetClientRect GetClipCursor GetCursorPos GetDC GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMenuBarInfo GetMenuItemInfoW GetMessageA GetMessageW GetMonitorInfoW GetParent GetRawInputData GetSystemMenu GetSystemMetrics GetTouchInputInfo GetUpdateRect GetWindow GetWindowDC GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InsertMenuW InvalidateRect InvalidateRgn IsIconic IsProcessDPIAware IsWindowEnabled IsWindowVisible KillTimer LoadCursorW LoadImageW MapVirtualKeyExW MapVirtualKeyW MapWindowPoints MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OffsetRect PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassExW RegisterClassW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageTimeoutW SendMessageW SetCapture SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoW SetParent SetPropW SetTimer SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicodeEx TrackMouseEvent TrackPopupMenu TranslateAcceleratorW TranslateMessage UpdateWindow ValidateRect VkKeyScanW

gdi32

BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps SelectObject SetBkMode SetTextColor

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

ole32

CoCreateInstance CoInitialize CoInitializeEx CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

shell32

DragFinish DragQueryFileW ILCreateFromPathW ILFree SHAppBarMessage SHChangeNotify SHCreateItemFromParsingName SHGetKnownFolderPath SHGetStockIconInfo SHOpenFolderAndSelectItems ShellExecuteExW ShellExecuteW Shell_NotifyIconGetRect Shell_NotifyIconW

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext

advapi32

EventRegister EventSetInformation EventUnregister EventWriteTransfer RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-string-l1-1-0

_wcsicmp strcmp strcpy_s strlen wcscmp wcslen wcsncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr floor pow round roundf trunc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

421B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

71d7190d5c5ff8ed.exe

bcryptprimitives

ntdll

kernel32

user32

gdi32

combase

ole32

comctl32

shell32

dwmapi

oleaut32

imm32

advapi32

api-ms-win-core-winrt-error-l1-1-0

shlwapi

api-ms-win-core-synch-l1-2-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic