6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0[.]zip

General

Target
6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0.zip
Size 2.4MB
Sample230501-p3a5lsfe69
SHA256 6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0
MD5 c96277417b22b02300f8573a2ee5cddd
SHA1 c3afa5ff29b260f4e8eea5f35e1ec39309bd5421
SHA512 3de831ad79ddc2d122dde52f60cd7eac27b83cbf688f85b74d37eb3a636b98b3cf151b02bc107d50ba36be13fe455ac1a89e2fe0183e7be386673f9a7a90366f
SSDEEP 12288:NTYV+u9dWbjVpGNGpKaj8qjhTcDxzV7jqlfhf6yz9OeNi:CVCfVeyjJhmNV6lFLz9OeNi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/update.exe

File Explorer

6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0.zip

.zip 2.4MB
update.exe

.exe 1024.0MB

6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0.zip

SHA256 6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0
MD5 c96277417b22b02300f8573a2ee5cddd
SHA1 c3afa5ff29b260f4e8eea5f35e1ec39309bd5421
SHA512 3de831ad79ddc2d122dde52f60cd7eac27b83cbf688f85b74d37eb3a636b98b3cf151b02bc107d50ba36be13fe455ac1a89e2fe0183e7be386673f9a7a90366f
SSDEEP 12288:NTYV+u9dWbjVpGNGpKaj8qjhTcDxzV7jqlfhf6yz9OeNi:CVCfVeyjJhmNV6lFLz9OeNi
MD5 SHA1 SHA512 SSDEEP

update.exe

IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
SHA256 4f67eda04defdf40355ab17ff4d72f0270f6265ad39f918ecab8a11727832e22
MD5 266a9e038cfb90db7fa5d45282dac72d
SHA1 6bf5ebe90c764e7d82c6c8e75c2ce3418dd923e0
SHA512 1358982cb90e763c88338c1a90c24e2b46ea7f521e4023a9a02ef5d9d1b802035808d9d055e9c0f297f33d7c099fd4e8b6fe1b5be9e0d38919a680262f8227ae
SSDEEP 12288:84mT/RcXtvyJdBQhXVQpPDv4aloZqby13caYgd2DBAm:84C/6XtvWBmQpPTXgcaYgdCA
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

368896

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

403KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

459KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

97KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0.zip

update.exe

kernel32