1cNuZBY0rGX-WyLN[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1cNuZBY0rGX-WyLN.exe
Size 3.6MB
Sample261104-zzxjjsdv4x
SHA256 d869738e3908aa88348bf51d97d1a60237f97c0b8850ee6304ff6572451a7f9c
MD5 ea67ea03946095691692c7e973668fca
SHA1 974f81910f95ac3456f255352fadaf2bf6df94e4
SHA512 897af572f667525aa7ad1b0964fb22a6be2dfc7f349b75f175d55ff62fb4336e953626472f2aa7ab056c4c3d8be806d684ad9461e3de9d9fe17ccede24ecf39a
SSDEEP 24576:3pCho/ZzZIc/UweljgtzZfSfCkUJN7EzDNXZhDUEKurh3lo6ODRpbVpyGO7uN3pi:5CheD/jsUVSOjAzDNXTKNldIwMbD+Q
TLSH
T17D066D8682910871EEBBB03605433A124BB7513957A6F150DAE8D13A7CC36DEF6B6F70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
1cNuZBY0rGX-WyLN.exe

File Explorer

1cNuZBY0rGX-WyLN.exe

.exe 3.6MB

1cNuZBY0rGX-WyLN.exe

IMPHASH fa08d1b61d1a8acc64f563085702c9ed
SHA256 d869738e3908aa88348bf51d97d1a60237f97c0b8850ee6304ff6572451a7f9c
MD5 ea67ea03946095691692c7e973668fca
SHA1 974f81910f95ac3456f255352fadaf2bf6df94e4
SHA512 897af572f667525aa7ad1b0964fb22a6be2dfc7f349b75f175d55ff62fb4336e953626472f2aa7ab056c4c3d8be806d684ad9461e3de9d9fe17ccede24ecf39a
SSDEEP 24576:3pCho/ZzZIc/UweljgtzZfSfCkUJN7EzDNXZhDUEKurh3lo6ODRpbVpyGO7uN3pi:5CheD/jsUVSOjAzDNXTKNldIwMbD+Q
TLSH
T17D066D8682910871EEBBB03605433A124BB7513957A6F150DAE8D13A7CC36DEF6B6F70
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fd:bc:d8:98:d7:66:0b:d2:29:5d:f3:3f:14:8c:c4:65:75:68:5a:d9:91:24:6c:11:65:a0:e5:bb:46:79:7d:ec

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Runtime Service,O=Oracle Corporation,C=US

Chains

Oct 26, 2026

CN=Runtime Service,O=Oracle Corporation,C=US

Minor OS version

Major OS version

Entry point

59608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptReleaseContext

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

oleaut32

SafeArrayCreateVector SafeArrayDestroy SafeArrayPutElement SysAllocString SysFreeString VariantInit

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

user32

GetDesktopWindow MessageBoxA

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc

api-ms-win-crt-private-l1-1-0

__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fwrite

kernel32

CloseHandle CreateFileA DeleteCriticalSection DeleteFileA EnterCriticalSection FlushFileBuffers FreeLibrary GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableA GetFileAttributesA GetFileSize GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetSystemDirectoryA GetTempPathA GetTickCount GetWindowsDirectoryA HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExA LocalFree ReadFile SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile

ntdll

NtAllocateVirtualMemory NtFreeVirtualMemory

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

426KB

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1cNuZBY0rGX-WyLN.exe

PE Signature issue

advapi32

ole32

oleaut32

winhttp

user32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

kernel32

ntdll

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

generic