distantly[.]dat | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
distantly.dat
Size 682KB
Sample230602-m7475sba85
SHA256 7bfa0fc80cf1b4dc110356aad858ed3638985dce794286dfe9a25ff3869fed02
MD5 5f1e08625d65bb93e8bf4611d2ee9070
SHA1 56fc9eb319ac902ac7e26357bd4cc598a3644d38
SHA512 94de1f8c3da8439f6bee529cf6e4d10979ca757af0b30f27b7d9f2d0dbbd18051c9b49e3c7470c2c271bbf1221986497e266168ff9a2d47d5b47924eac7fd011
SSDEEP 12288:dDxy+2MIBYYimb3oG11xfTUOz3dluiIIN:Vg+2MIBYkb4G11hTsi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
distantly.dat

File Explorer

distantly.dat

.dll 682KB

distantly.dat

IMPHASH 1cba0e23b706e0bfbc0a4cb9b6bd80fb
SHA256 7bfa0fc80cf1b4dc110356aad858ed3638985dce794286dfe9a25ff3869fed02
MD5 5f1e08625d65bb93e8bf4611d2ee9070
SHA1 56fc9eb319ac902ac7e26357bd4cc598a3644d38
SHA512 94de1f8c3da8439f6bee529cf6e4d10979ca757af0b30f27b7d9f2d0dbbd18051c9b49e3c7470c2c271bbf1221986497e266168ff9a2d47d5b47924eac7fd011
SSDEEP 12288:dDxy+2MIBYYimb3oG11xfTUOz3dluiIIN:Vg+2MIBYkb4G11hTsi
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5232

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

lcopy_block_row lcopy_sample_rows ldiv_round_up linit_1pass_quantizer linit_2pass_quantizer linit_c_coef_controller linit_c_main_controller linit_c_master_control linit_c_prep_controller linit_color_converter linit_color_deconverter linit_compress_master linit_d_coef_controller linit_d_main_controller linit_d_post_controller linit_downsampler linit_forward_dct linit_huff_decoder linit_huff_encoder linit_input_controller linit_inverse_dct linit_marker_reader linit_marker_writer linit_master_decompress linit_memory_mgr linit_merged_upsampler linit_phuff_decoder linit_phuff_encoder linit_upsampler lpeg_CreateCompress lpeg_CreateDecompress lpeg_abort lpeg_abort_compress lpeg_abort_decompress lpeg_add_quant_table lpeg_alloc_huff_table lpeg_alloc_quant_table lpeg_calc_output_dimensions lpeg_consume_input lpeg_copy_critical_parameters lpeg_crop_scanline lpeg_default_colorspace lpeg_destroy lpeg_destroy_compress lpeg_destroy_decompress lpeg_fdct_float lpeg_fdct_ifast lpeg_fdct_islow lpeg_fill_bit_buffer lpeg_finish_compress lpeg_finish_decompress lpeg_finish_output lpeg_free_large lpeg_free_small lpeg_gen_optimal_table lpeg_get_large lpeg_get_small lpeg_has_multiple_scans lpeg_huff_decode lpeg_idct_1x1 lpeg_idct_2x2 lpeg_idct_4x4 lpeg_idct_float lpeg_idct_ifast lpeg_idct_islow lpeg_input_complete lpeg_make_c_derived_tbl lpeg_make_d_derived_tbl lpeg_mem_available lpeg_mem_dest lpeg_mem_init lpeg_mem_src lpeg_mem_term lpeg_new_colormap lpeg_open_backing_store lpeg_quality_scaling lpeg_read_coefficients lpeg_read_header lpeg_read_raw_data lpeg_read_scanlines lpeg_resync_to_restart lpeg_save_markers lpeg_set_colorspace lpeg_set_defaults lpeg_set_linear_quality lpeg_set_marker_processor lpeg_set_quality lpeg_simple_progression lpeg_skip_scanlines lpeg_start_compress lpeg_start_decompress lpeg_start_output lpeg_std_error lpeg_stdio_dest lpeg_stdio_src lpeg_suppress_tables lpeg_write_coefficients lpeg_write_m_byte lpeg_write_m_header lpeg_write_marker lpeg_write_raw_data lpeg_write_scanlines lpeg_write_tables lround_up next

Name

.text

Size

275KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

996B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

512B

Virtual Size

135B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

108KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

distantly.dat

kernel32

msvcrt