04ab212dd768968b1cb025b40664d997[.]exe

General

Target
04ab212dd768968b1cb025b40664d997.exe
Size 325KB
Sample261110-mc7psa1zhy
SHA256 2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879
MD5 04ab212dd768968b1cb025b40664d997
SHA1 78cb0edc6fab765ebb8a4f6467e09c745d52c330
SHA512 387a35a66dc269db2bdfd3d5420b08af3fb44ebc4a5ed85c3174ea968fbb4133e11704a0e5752dfe4e32f34edfe816707cf183e9c2a8c38fe4f9a6340c45664f
SSDEEP 6144:I5y5K3rwaovrjVo35FKbCmtpRCv2PlJQ:ay5eEaovNo35gbFtrC6
TLSH
T1D4645C117AA117E5C0A1A8FCA1616100DAF7B8A397D855CB0FA257B7CD3B1C1DF3BA60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04ab212dd768968b1cb025b40664d997.exe

File Explorer

04ab212dd768968b1cb025b40664d997.exe

.exe 325KB

04ab212dd768968b1cb025b40664d997.exe

IMPHASH 929a3b5097dd08c234b7d5d8e867aa97
SHA256 2e93ca8ce2c283e68bafc0dbf16e2d50e8a370d24f74aa0c1120c8ac73b2d879
MD5 04ab212dd768968b1cb025b40664d997
SHA1 78cb0edc6fab765ebb8a4f6467e09c745d52c330
SHA512 387a35a66dc269db2bdfd3d5420b08af3fb44ebc4a5ed85c3174ea968fbb4133e11704a0e5752dfe4e32f34edfe816707cf183e9c2a8c38fe4f9a6340c45664f
SSDEEP 6144:I5y5K3rwaovrjVo35FKbCmtpRCv2PlJQ:ay5eEaovNo35gbFtrC6
TLSH
T1D4645C117AA117E5C0A1A8FCA1616100DAF7B8A397D855CB0FA257B7CD3B1C1DF3BA60
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

PathFileExistsW StrStrIA

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpReceiveResponse WinHttpCloseHandle WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest

advapi32

ConvertSidToStringSidW GetUserNameW GetTokenInformation OpenProcessToken

kernel32

HeapSize SetFilePointerEx GetProcessHeap GetConsoleOutputCP VirtualProtect InitializeCriticalSectionEx GetConsoleMode WriteConsoleW LCMapStringW RtlUnwindEx FlsFree FlsSetValue GetLastError MultiByteToWideChar GetLocalTime GetCurrentProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle LocalFree GetComputerNameW GetCurrentProcessId CreateDirectoryW ReadFile WriteFile SetFilePointer CreateFileW LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime WideCharToMultiByte GetEnvironmentVariableW SetEndOfFile LocalAlloc SetCurrentDirectoryW CreateProcessW FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW FlsGetValue RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle GetModuleFileNameW HeapFree HeapAlloc GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc

Name

.text

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

04ab212dd768968b1cb025b40664d997.exe

shlwapi

winhttp

advapi32

kernel32

generic