81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea.exe
Size 798KB
Sample261113-arax5sys6l
SHA256 81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea
MD5 f072063feeea686498156ca7553eb770
SHA1 86784be672eef4da7d2215b99b1b196a299b6131
SHA512 da3dbafdccc712bd69597fed8dcd3d2911fb9e6027a6e6da1f1a671f7a70fca1699cd2e71b21a6ca206622d0a82e543e9063537a8d09ea68700af3dcab50985d
SSDEEP 12288:O44Ls6dc0Lnr098BJHklgjcNMFGkQtmTwvwD2nyksmsJpGhkVcxbNvakd6wTnuun:6/687WggywzmbDcyklCGOVcxxvZd6kf
TLSH
T14E0501D0F79217E8D52AC67489525E16EA613C011B3065FF178833A60E32BD2EF7BB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea.exe

File Explorer

81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea.exe

.exe 798KB

81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea.exe

IMPHASH 40cd6baf768c0bc4682b7fa1e156180c
SHA256 81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea
MD5 f072063feeea686498156ca7553eb770
SHA1 86784be672eef4da7d2215b99b1b196a299b6131
SHA512 da3dbafdccc712bd69597fed8dcd3d2911fb9e6027a6e6da1f1a671f7a70fca1699cd2e71b21a6ca206622d0a82e543e9063537a8d09ea68700af3dcab50985d
SSDEEP 12288:O44Ls6dc0Lnr098BJHklgjcNMFGkQtmTwvwD2nyksmsJpGhkVcxbNvakd6wTnuun:6/687WggywzmbDcyklCGOVcxxvZd6kf
TLSH
T14E0501D0F79217E8D52AC67489525E16EA613C011B3065FF178833A60E32BD2EF7BB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

smebridix.pdb

kernel32

CloseHandle CompareStringW CreateFileW CreateMutexW DeleteCriticalSection DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleTitleW GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalDriveStringsW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNumberOfConsoleInputEvents GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTimeFormatW GetUserDefaultLCID GetVolumeInformationW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

shell32

CommandLineToArgvW

user32

GetActiveWindow GetClassNameW GetClientRect GetClipboardSequenceNumber GetCursorPos GetDesktopWindow GetDoubleClickTime GetFocus GetForegroundWindow GetSystemMetrics GetWindowLongPtrW GetWindowRect GetWindowThreadProcessId IsIconic ScreenToClient

gdi32

GetStockObject

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile

Name

.text

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

303KB

Virtual Size

303KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

335KB

Virtual Size

337KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

257B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea.exe

kernel32

shell32

user32

gdi32

api-ms-win-core-synch-l1-2-0

ntdll

generic