Ta[.]zip | Triage™

General

Target
Ta.zip
Size 2.4MB
Sample230501-nlewsshb5s
SHA256 458bacf7b28381813ab395db163843e71f62a830db1e1274178c14d91d435ca6
MD5 207755332e7de0ac43bce9ec59534e30
SHA1 ea8b222d0c09a704e0b84a97ed480be4d2360d38
SHA512 9e0086b1afcbdde339de0f2384e7170693c7eb08832e17f7a7c4e0ff53b3b8ee8e8c10a2fda5353a57df33b483af5cd406b954fe86c900d177ca434128d6cd24
SSDEEP 12288:u1F1xdEl2aB9GfUh2m3Nx+3ezaOkkTJTIVF/K2EKL9EVQa:AF1xul2aB9RhBb+UjT+VJaIOVB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Ta.exe

File Explorer

Ta.zip

.zip 2.4MB
Ta.exe

.exe 1024.0MB

Ta.zip

SHA256 458bacf7b28381813ab395db163843e71f62a830db1e1274178c14d91d435ca6
MD5 207755332e7de0ac43bce9ec59534e30
SHA1 ea8b222d0c09a704e0b84a97ed480be4d2360d38
SHA512 9e0086b1afcbdde339de0f2384e7170693c7eb08832e17f7a7c4e0ff53b3b8ee8e8c10a2fda5353a57df33b483af5cd406b954fe86c900d177ca434128d6cd24
SSDEEP 12288:u1F1xdEl2aB9GfUh2m3Nx+3ezaOkkTJTIVF/K2EKL9EVQa:AF1xul2aB9RhBb+UjT+VJaIOVB
MD5 SHA1 SHA512 SSDEEP

Ta.exe

IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
SHA256 4b34980497ed08e0f3958cc83b63dbf5cd84879333d176e8df5910694ec728ae
MD5 ad6af2d313b7118ff811eeaa49e740ad
SHA1 f3ea74dae94644c095674bd8d1619a979388d569
SHA512 8a6cad20817c4c118c9c09a7f59b70d5fe17ee39576eedf8c27c2765e84ca45af4e12b760966f882ca148de47a81d72e90331f058e08787cb9b2150cd969ec4f
SSDEEP 12288:94mT/RcXtvyJdBQhXVQprDv4alfZqby13caYgd2Dm/txt:94C/6XtvWBmQprT4gcaYgdPD
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

368896

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

403KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

459KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

97KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Ta.zip

Ta.exe

kernel32