transfer[.]sh_17thKg_Ta[.]zip

General

Target
transfer.sh_17thKg_Ta.zip
Size 2.4MB
Sample230504-ml58bade3x
SHA256 042ece478eb57f80509a6b318e33830ccd144ff187197a91cb5e9451a4918ec1
MD5 6d136d94c1a14c65ba3a6b2b09a491a9
SHA1 3ee0979ad276b54311ba24cff4b73cf5de8711e2
SHA512 814c5b5e379ad6b037a5a2c4ade281bb770194157b9e72673583b8c3788eaf6f2f3c053e67236f6061e11623d4fba4ca8217a8e3f61c3f3bc32d86ddff28a310
SSDEEP 12288:KklVV+u9dWbjVpGNGGzsJvVnMal6h84q1B/CC:Kk3VCfVeFKtMawaBp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Ta.exe

File Explorer

transfer.sh_17thKg_Ta.zip

.zip 2.4MB
Ta.exe

.exe 1024.0MB

transfer.sh_17thKg_Ta.zip

SHA256 042ece478eb57f80509a6b318e33830ccd144ff187197a91cb5e9451a4918ec1
MD5 6d136d94c1a14c65ba3a6b2b09a491a9
SHA1 3ee0979ad276b54311ba24cff4b73cf5de8711e2
SHA512 814c5b5e379ad6b037a5a2c4ade281bb770194157b9e72673583b8c3788eaf6f2f3c053e67236f6061e11623d4fba4ca8217a8e3f61c3f3bc32d86ddff28a310
SSDEEP 12288:KklVV+u9dWbjVpGNGGzsJvVnMal6h84q1B/CC:Kk3VCfVeFKtMawaBp
MD5 SHA1 SHA512 SSDEEP

Ta.exe

IMPHASH f0ea7b7844bbc5bfa9bb32efdcea957c
SHA256 3ae0b6a4b5f4733df33d3962f6911c32d0e21e119fb3dfb93598460f67ff17ff
MD5 2cae069aa7b7d01aa0518ce54131e797
SHA1 484f33776492a78958914c3a637615e30b3acebb
SHA512 b23b27ae9431846223442da391e9d3d7cc4fc9f30603c8283b03da47f0994cc8a8b22a60d90e36faadeb22f6e70bbd4a6fb1fa5816e411e228158c771ab93275
SSDEEP 12288:l4mT/RcXtvyJdBQhXVQpmDv4alfZqby13caYgd2D0gjDsTrU:l4C/6XtvWBmQpmT4gcaYgdBgjDsPU
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

368896

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

403KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

459KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

97KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

transfer.sh_17thKg_Ta.zip

Ta.exe

kernel32