thenMan[.]db[.]7z | Triage™

General

Target
thenMan.db.7z
Size 65KB
Sample220825-22dwbsdbb6
SHA256 24e5ff0c2d31f0be274a3febb2bd945dcb481efb8a20c0fb40b203d5d8f18037
MD5 7fb82f94796c44e7db5250aa060dc4f0
SHA1 e1e478102556766ce3b18b140220bf9e675fb9d7
SHA512 e5c789070e9c6617c41a61289271dc0c779e4c90630ccff2af92a7df071de1fce4f6203d3c88a7329732432bea110c547e71d85986c21b775f21fe922a90b8fd
SSDEEP 1536:VKKkJDogr0nhSlniLK5ayJLLNibAd7ER5GVF6D:VAoJSlniLMIT5s
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

thenMan.db.7z

.7z 65KB
thenMan.db

.dll 239KB

thenMan.db.7z

SHA256 24e5ff0c2d31f0be274a3febb2bd945dcb481efb8a20c0fb40b203d5d8f18037
MD5 7fb82f94796c44e7db5250aa060dc4f0
SHA1 e1e478102556766ce3b18b140220bf9e675fb9d7
SHA512 e5c789070e9c6617c41a61289271dc0c779e4c90630ccff2af92a7df071de1fce4f6203d3c88a7329732432bea110c547e71d85986c21b775f21fe922a90b8fd
SSDEEP 1536:VKKkJDogr0nhSlniLK5ayJLLNibAd7ER5GVF6D:VAoJSlniLMIT5s
MD5 SHA1 SHA512 SSDEEP

Password

infected

thenMan.db

IMPHASH 98e8e19216c5d12e16a27545539951ac
SHA256 0fec101aaf5e06c49a85c1697bd58bff2496344598397e6f516e073170e4a7a2
MD5 ede6aa430fe8075b9539e78092055f08
SHA1 0f1480c163cd21da73d48f8faac6c82e87d435d8
SHA512 2d54aeb905313090826115244cdc4061380c926da0ec9102246788f6bf976916a1335037ad12c60a6c6589a2029d6af83befd7b62951dd8eec4e05c17ec1670d
SSDEEP 3072:xjODFE8MGrZIiDamI3ur3no8TjTjObmLkzmG+1+uAm4iUOke5J4dR6WWI6YYIsMh:xjyFFMGrZIi1I3uRkde50mdAgIulg
MD5 SHA1 SHA512 SSDEEP

windows x64

Password

infected

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shtll

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.src

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ePGb

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

thenMan.db.7z

thenMan.db

gdi32

uxtheme

rasapi32

Sharing

General

Malware Config

Signatures

File Explorer

thenMan.db.7z

thenMan.db

gdi32

uxtheme

rasapi32