819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe
Size 2.6MB
Sample261109-kt2trawv2j
SHA256 819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d
MD5 0f575e7cd23e5fd894c24610ffb2db5f
SHA1 25cd1d404424d40b9f83c3ff5431759fec18bed0
SHA512 c6b5cfa0a08d01011a67978362aa2387b025a3eca80fb8e296e099ba49113ef825db08a6c1f1de583ae51af86fbd67ba5e3774dd1927fce6f304e0cc29e52571
SSDEEP 49152:qidDZK+GOp0PSAwGIQ8JnjpzHVDLZHGABhtm6q:qiq7Sj3j/HFHw6q
TLSH
T120C5AD36B1838A71E5B6033049A9F3B096AEBE054731AA97F3D4F30D1C751969B2B353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe

File Explorer

819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe

.exe 2.6MB

819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe

IMPHASH e3220b29bcb828d950472feec27bbc25
SHA256 819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d
MD5 0f575e7cd23e5fd894c24610ffb2db5f
SHA1 25cd1d404424d40b9f83c3ff5431759fec18bed0
SHA512 c6b5cfa0a08d01011a67978362aa2387b025a3eca80fb8e296e099ba49113ef825db08a6c1f1de583ae51af86fbd67ba5e3774dd1927fce6f304e0cc29e52571
SSDEEP 49152:qidDZK+GOp0PSAwGIQ8JnjpzHVDLZHGABhtm6q:qiq7Sj3j/HFHw6q
TLSH
T120C5AD36B1838A71E5B6033049A9F3B096AEBE054731AA97F3D4F30D1C751969B2B353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

224497

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueW OpenProcessToken RegisterEventSourceW ReportEventW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

kernel32

AddVectoredExceptionHandler CancelThreadpoolIo CloseHandle CloseThreadpoolIo CopyContext CreateDirectoryW CreateEventExW CreateEventW CreateFileW CreateMemoryResourceNotification CreateThread CreateThreadpoolIo DebugBreak DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FlsAlloc FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FlushProcessWriteBuffers FormatMessageW FreeLibrary GetCommandLineW GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetCurrentThreadId GetEnabledXStateFeatures GetEnvironmentVariableW GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLargePageMinimum GetLastError GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNumaHighestNodeNumber GetOverlappedResult GetProcAddress GetProcessAffinityMask GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount64 GetWriteWatch GlobalMemoryStatusEx InitializeConditionVariable InitializeContext InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessInJob IsProcessorFeaturePresent K32GetProcessMemoryInfo LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency RaiseException RaiseFailFastException ReadFile ResetEvent ResetWriteWatch ResumeThread RtlCaptureContext RtlUnwind SetEvent SetFileInformationByHandle SetLastError SetThreadContext SetThreadErrorMode SetThreadPriority SetUnhandledExceptionFilter SetXStateFeaturesMask Sleep SleepConditionVariableCS SleepEx StartThreadpoolIo SuspendThread SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualAllocExNuma VirtualFree VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WakeConditionVariable WideCharToMultiByte WriteFile

ole32

CoCreateGuid CoGetApartmentType CoInitializeEx CoTaskMemFree CoUninitialize CoWaitForMultipleHandles

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _controlfp_s _crt_atexit _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-string-l1-1-0

_stricmp strcpy_s wcsncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil modf

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

978KB

Virtual Size

978KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

862KB

Virtual Size

862KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

169B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

364KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

819d4d31b2c839fc0d8ea8dbcf7bc90b6ebb7f90e63d9b0dfc70078c1989f26d.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic