Binary[.]IKLMUbAf[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Binary.IKLMUbAf.exe
Size 5.1MB
Sample261113-pdefqsvs9k
SHA256 1c741595f6392c2d6167648a9563e1650b0f001ecd2655aa7dac6557f0cd0895
MD5 229de7f7340d45e74749978d25f99deb
SHA1 fcc829f4a247883d5310ab4b20e6d45082501ec8
SHA512 daf65c7f5925a9580016221457348299268a6c1d1e4f4985ed555675ebf55af3877e9686a0965740b9b8f7fbd5488c637b8b288736a0da6ba3ea2b1a5738549b
SSDEEP 49152:DYZqSFUV1FIsnADZ8EjxMRtDAha6JHEoPwvDcRvSVJ6nMfgxKHiF:PaUCsYZRWRtAhdPwLcN0AC
TLSH
T1EE462324A3E940EDE063613CC9668642E3B77869877456FB476007B4BE272D1AE3DF31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Binary.IKLMUbAf.exe

File Explorer

Binary.IKLMUbAf.exe

.exe 5.1MB

Binary.IKLMUbAf.exe

IMPHASH 042cef985c41d09d4fa3085d4aa3cc67
SHA256 1c741595f6392c2d6167648a9563e1650b0f001ecd2655aa7dac6557f0cd0895
MD5 229de7f7340d45e74749978d25f99deb
SHA1 fcc829f4a247883d5310ab4b20e6d45082501ec8
SHA512 daf65c7f5925a9580016221457348299268a6c1d1e4f4985ed555675ebf55af3877e9686a0965740b9b8f7fbd5488c637b8b288736a0da6ba3ea2b1a5738549b
SSDEEP 49152:DYZqSFUV1FIsnADZ8EjxMRtDAha6JHEoPwvDcRvSVJ6nMfgxKHiF:PaUCsYZRWRtAhdPwLcN0AC
TLSH
T1EE462324A3E940EDE063613CC9668642E3B77869877456FB476007B4BE272D1AE3DF31
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteConsoleW CreateFileW CloseHandle GetUserDefaultLCID GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetComputerNameW MulDiv GetLocalTime GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetCurrentThreadId QueryPerformanceCounter GetLastError GetTempPathW GetConsoleMode Sleep GetProcessHeap LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetCurrentProcess TerminateProcess GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

user32

MessageBoxW GetWindowTextLengthW GetDoubleClickTime GetKeyboardType GetSystemMetrics IsWindowVisible FindWindowW GetForegroundWindow

gdi32

DeleteObject CreateFontW GetDeviceCaps

advapi32

RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey GetUserNameW RegQueryValueExW

ole32

CoCreateInstance CLSIDFromString CoTaskMemAlloc CoTaskMemFree CoInitializeEx CoUninitialize

shlwapi

PathIsDirectoryW StrStrW PathCombineW PathFileExistsW PathRemoveFileSpecW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.debug

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

BSS

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Binary.IKLMUbAf.exe

kernel32

user32

gdi32

advapi32

ole32

shlwapi

version

generic