505056[.]dat[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
505056.dat.exe
Size 825KB
Sample230705-yldc3sgh81
SHA256 045dff9f14a03225df55997cb2ca74ff60ecaf317b9e033ea93386785db84161
MD5 c3da812bd1009dc1e33a952f3b84b9ca
SHA1 657c03f30566ea091798801db681f1448dc57faa
SHA512 5610f0de3cfee06674238f04e9a6820498d2ff908890372c18b070e61bd9f933fa77f4918d16364a26bde590c6213c171a5145822a155d9c704cb0609c493b9c
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9PF3NL:WF+uTsAx0tlpidvdkhF3NL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
505056.dat.exe

File Explorer

505056.dat.exe

.dll 825KB

505056.dat.exe

IMPHASH fcd69661d52485330c4a65d12b66db6d
SHA256 045dff9f14a03225df55997cb2ca74ff60ecaf317b9e033ea93386785db84161
MD5 c3da812bd1009dc1e33a952f3b84b9ca
SHA1 657c03f30566ea091798801db681f1448dc57faa
SHA512 5610f0de3cfee06674238f04e9a6820498d2ff908890372c18b070e61bd9f933fa77f4918d16364a26bde590c6213c171a5145822a155d9c704cb0609c493b9c
SSDEEP 24576:yVVT+XirpTs7sx0QBnoNjla+idlpdIF9PF3NL:WF+uTsAx0tlpidvdkhF3NL
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4944

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

tOVER_best_destroy tOVER_best_finish tOVER_best_init tOVER_best_start tOVER_best_wait tOVER_checkTotalCompressedSize tOVER_computeEpochs tOVER_dictSelectionError tOVER_dictSelectionFree tOVER_dictSelectionIsError tOVER_selectDict tOVER_sum tOVER_warnOnSmallCorpus tRR_getErrorString tSE_NCountWriteBound tSE_buildCTable_raw tSE_buildCTable_rle tSE_buildCTable_wksp tSE_buildDTable tSE_buildDTable_raw tSE_buildDTable_rle tSE_buildDTable_wksp tSE_compress tSE_compress2 tSE_compressBound tSE_compress_usingCTable tSE_compress_wksp tSE_createCTable tSE_createDTable tSE_decompress tSE_decompress_usingDTable tSE_decompress_wksp tSE_decompress_wksp_bmi2 tSE_freeCTable tSE_freeDTable tSE_getErrorName tSE_isError tSE_normalizeCount tSE_optimalTableLog tSE_optimalTableLog_internal tSE_readNCount tSE_readNCount_bmi2 tSE_versionNumber tSE_writeNCount tIST_count tIST_countFast tIST_countFast_wksp tIST_count_simple tIST_count_wksp tIST_isError tUF_buildCTable tUF_buildCTable_wksp tUF_compress tUF_compress1X tUF_compress1X_repeat tUF_compress1X_usingCTable tUF_compress1X_usingCTable_bmi2 tUF_compress1X_wksp tUF_compress2 tUF_compress4X_repeat tUF_compress4X_usingCTable tUF_compress4X_usingCTable_bmi2 tUF_compress4X_wksp tUF_compressBound tUF_decompress tUF_decompress1X1 tUF_decompress1X1_DCtx tUF_decompress1X1_DCtx_wksp tUF_decompress1X1_DCtx_wksp_bmi2 tUF_decompress1X1_usingDTable tUF_decompress1X2 tUF_decompress1X2_DCtx tUF_decompress1X2_DCtx_wksp tUF_decompress1X2_usingDTable tUF_decompress1X_DCtx tUF_decompress1X_DCtx_wksp tUF_decompress1X_usingDTable tUF_decompress1X_usingDTable_bmi2 tUF_decompress4X1 tUF_decompress4X1_DCtx tUF_decompress4X1_DCtx_wksp tUF_decompress4X1_usingDTable tUF_decompress4X2 tUF_decompress4X2_DCtx tUF_decompress4X2_DCtx_wksp tUF_decompress4X2_usingDTable tUF_decompress4X_DCtx tUF_decompress4X_hufOnly tUF_decompress4X_hufOnly_wksp tUF_decompress4X_hufOnly_wksp_bmi2 tUF_decompress4X_usingDTable tUF_decompress4X_usingDTable_bmi2 tUF_estimateCompressedSize tUF_getErrorName tUF_getNbBitsFromCTable tUF_isError tUF_optimalTableLog tUF_readCTable tUF_readDTableX1 tUF_readDTableX1_wksp tUF_readDTableX1_wksp_bmi2 tUF_readDTableX2 tUF_readDTableX2_wksp tUF_readDTableX2_wksp_bmi2 tUF_readStats tUF_readStats_wksp tUF_selectDecoder tUF_validateCTable tUF_writeCTable tUF_writeCTable_wksp tOOL_add tOOL_create tOOL_create_advanced tOOL_free tOOL_resize tOOL_sizeof tOOL_tryAdd tDICT_addEntropyTablesFromBuffer tDICT_finalizeDictionary tDICT_getDictHeaderSize tDICT_getDictID tDICT_getErrorName tDICT_isError tDICT_optimizeTrainFromBuffer_cover tDICT_optimizeTrainFromBuffer_fastCover tDICT_trainFromBuffer tDICT_trainFromBuffer_cover tDICT_trainFromBuffer_fastCover tDICT_trainFromBuffer_legacy tSTDMT_compressStream_generic tSTDMT_createCCtx_advanced tSTDMT_freeCCtx tSTDMT_getFrameProgression tSTDMT_initCStream_internal tSTDMT_nextInputSizeHint tSTDMT_sizeof_CCtx tSTDMT_toFlushNow tSTDMT_updateCParams_whileCompressing tSTD_CCtxParams_getParameter tSTD_CCtxParams_init tSTD_CCtxParams_init_advanced tSTD_CCtxParams_reset tSTD_CCtxParams_setParameter tSTD_CCtx_getParameter tSTD_CCtx_loadDictionary tSTD_CCtx_loadDictionary_advanced tSTD_CCtx_loadDictionary_byReference tSTD_CCtx_refCDict tSTD_CCtx_refPrefix tSTD_CCtx_refPrefix_advanced tSTD_CCtx_refThreadPool tSTD_CCtx_reset tSTD_CCtx_setParameter tSTD_CCtx_setParametersUsingCCtxParams tSTD_CCtx_setPledgedSrcSize tSTD_CCtx_trace tSTD_CStreamInSize tSTD_CStreamOutSize tSTD_DCtx_getParameter tSTD_DCtx_loadDictionary tSTD_DCtx_loadDictionary_advanced tSTD_DCtx_loadDictionary_byReference tSTD_DCtx_refDDict tSTD_DCtx_refPrefix tSTD_DCtx_refPrefix_advanced tSTD_DCtx_reset tSTD_DCtx_setFormat tSTD_DCtx_setMaxWindowSize tSTD_DCtx_setParameter tSTD_DDict_dictContent tSTD_DDict_dictSize tSTD_DStreamInSize tSTD_DStreamOutSize tSTD_XXH32 tSTD_XXH32_canonicalFromHash tSTD_XXH32_copyState tSTD_XXH32_createState tSTD_XXH32_digest tSTD_XXH32_freeState tSTD_XXH32_hashFromCanonical tSTD_XXH32_reset tSTD_XXH32_update tSTD_XXH64 tSTD_XXH64_canonicalFromHash tSTD_XXH64_copyState tSTD_XXH64_createState tSTD_XXH64_digest tSTD_XXH64_freeState tSTD_XXH64_hashFromCanonical tSTD_XXH64_reset tSTD_XXH64_update tSTD_XXH_versionNumber tSTD_adjustCParams tSTD_buildBlockEntropyStats tSTD_buildCTable tSTD_buildFSETable tSTD_cParam_getBounds tSTD_checkCParams tSTD_checkContinuity tSTD_compress tSTD_compress2 tSTD_compressBegin tSTD_compressBegin_advanced tSTD_compressBegin_advanced_internal tSTD_compressBegin_usingCDict tSTD_compressBegin_usingCDict_advanced tSTD_compressBegin_usingDict tSTD_compressBlock tSTD_compressBlock_btlazy2 tSTD_compressBlock_btlazy2_dictMatchState tSTD_compressBlock_btlazy2_extDict tSTD_compressBlock_btopt tSTD_compressBlock_btopt_dictMatchState tSTD_compressBlock_btopt_extDict tSTD_compressBlock_btultra tSTD_compressBlock_btultra2 tSTD_compressBlock_btultra_dictMatchState tSTD_compressBlock_btultra_extDict tSTD_compressBlock_doubleFast tSTD_compressBlock_doubleFast_dictMatchState tSTD_compressBlock_doubleFast_extDict tSTD_compressBlock_fast tSTD_compressBlock_fast_dictMatchState tSTD_compressBlock_fast_extDict tSTD_compressBlock_greedy tSTD_compressBlock_greedy_dedicatedDictSearch tSTD_compressBlock_greedy_dedicatedDictSearch_row tSTD_compressBlock_greedy_dictMatchState tSTD_compressBlock_greedy_dictMatchState_row tSTD_compressBlock_greedy_extDict tSTD_compressBlock_greedy_extDict_row tSTD_compressBlock_greedy_row tSTD_compressBlock_lazy tSTD_compressBlock_lazy2 tSTD_compressBlock_lazy2_dedicatedDictSearch tSTD_compressBlock_lazy2_dedicatedDictSearch_row tSTD_compressBlock_lazy2_dictMatchState tSTD_compressBlock_lazy2_dictMatchState_row tSTD_compressBlock_lazy2_extDict tSTD_compressBlock_lazy2_extDict_row tSTD_compressBlock_lazy2_row tSTD_compressBlock_lazy_dedicatedDictSearch tSTD_compressBlock_lazy_dedicatedDictSearch_row tSTD_compressBlock_lazy_dictMatchState tSTD_compressBlock_lazy_dictMatchState_row tSTD_compressBlock_lazy_extDict tSTD_compressBlock_lazy_extDict_row tSTD_compressBlock_lazy_row tSTD_compressBound tSTD_compressCCtx tSTD_compressContinue tSTD_compressEnd tSTD_compressLiterals tSTD_compressRleLiteralsBlock tSTD_compressSequences tSTD_compressStream tSTD_compressStream2 tSTD_compressStream2_simpleArgs tSTD_compressSuperBlock tSTD_compress_advanced tSTD_compress_advanced_internal tSTD_compress_usingCDict tSTD_compress_usingCDict_advanced tSTD_compress_usingDict tSTD_copyCCtx tSTD_copyDCtx tSTD_copyDDictParameters tSTD_createCCtx tSTD_createCCtxParams tSTD_createCCtx_advanced tSTD_createCDict tSTD_createCDict_advanced tSTD_createCDict_advanced2 tSTD_createCDict_byReference tSTD_createCStream tSTD_createCStream_advanced tSTD_createDCtx tSTD_createDCtx_advanced tSTD_createDDict tSTD_createDDict_advanced tSTD_createDDict_byReference tSTD_createDStream tSTD_createDStream_advanced tSTD_createThreadPool tSTD_crossEntropyCost tSTD_customCalloc tSTD_customFree tSTD_customMalloc tSTD_cycleLog tSTD_dParam_getBounds tSTD_decodeLiteralsBlock tSTD_decodeSeqHeaders tSTD_decodingBufferSize_min tSTD_decompress tSTD_decompressBegin tSTD_decompressBegin_usingDDict tSTD_decompressBegin_usingDict tSTD_decompressBlock tSTD_decompressBlock_internal tSTD_decompressBound tSTD_decompressContinue tSTD_decompressDCtx tSTD_decompressStream tSTD_decompressStream_simpleArgs tSTD_decompress_usingDDict tSTD_decompress_usingDict tSTD_dedicatedDictSearch_lazy_loadDictionary tSTD_defaultCLevel tSTD_encodeSequences tSTD_endStream tSTD_estimateCCtxSize tSTD_estimateCCtxSize_usingCCtxParams tSTD_estimateCCtxSize_usingCParams tSTD_estimateCDictSize tSTD_estimateCDictSize_advanced tSTD_estimateCStreamSize tSTD_estimateCStreamSize_usingCCtxParams tSTD_estimateCStreamSize_usingCParams tSTD_estimateDCtxSize tSTD_estimateDDictSize tSTD_estimateDStreamSize tSTD_estimateDStreamSize_fromFrame tSTD_fillDoubleHashTable tSTD_fillHashTable tSTD_findDecompressedSize tSTD_findFrameCompressedSize tSTD_flushStream tSTD_frameHeaderSize tSTD_freeCCtx tSTD_freeCCtxParams tSTD_freeCDict tSTD_freeCStream tSTD_freeDCtx tSTD_freeDDict tSTD_freeDStream tSTD_freeThreadPool tSTD_fseBitCost tSTD_generateSequences tSTD_getBlockSize tSTD_getCParams tSTD_getCParamsFromCCtxParams tSTD_getCParamsFromCDict tSTD_getDecompressedSize tSTD_getDictID_fromCDict tSTD_getDictID_fromDDict tSTD_getDictID_fromDict tSTD_getDictID_fromFrame tSTD_getErrorCode tSTD_getErrorName tSTD_getErrorString tSTD_getFrameContentSize tSTD_getFrameHeader tSTD_getFrameHeader_advanced tSTD_getFrameProgression tSTD_getParams tSTD_getSeqStore tSTD_getcBlockSize tSTD_initCStream tSTD_initCStream_advanced tSTD_initCStream_internal tSTD_initCStream_srcSize tSTD_initCStream_usingCDict tSTD_initCStream_usingCDict_advanced tSTD_initCStream_usingDict tSTD_initDStream tSTD_initDStream_usingDDict tSTD_initDStream_usingDict tSTD_initStaticCCtx tSTD_initStaticCDict tSTD_initStaticCStream tSTD_initStaticDCtx tSTD_initStaticDDict tSTD_initStaticDStream tSTD_insertAndFindFirstIndex tSTD_insertBlock tSTD_invalidateRepCodes tSTD_isError tSTD_isFrame tSTD_isSkippableFrame tSTD_ldm_adjustParameters tSTD_ldm_blockCompress tSTD_ldm_fillHashTable tSTD_ldm_generateSequences tSTD_ldm_getMaxNbSeq tSTD_ldm_getTableSize tSTD_ldm_skipRawSeqStoreBytes tSTD_ldm_skipSequences tSTD_loadCEntropy tSTD_loadDEntropy tSTD_maxCLevel tSTD_mergeBlockDelimiters tSTD_minCLevel tSTD_nextInputType tSTD_nextSrcSizeToDecompress tSTD_noCompressLiterals tSTD_pthread_create tSTD_pthread_join tSTD_readSkippableFrame tSTD_referenceExternalSequences tSTD_resetCStream tSTD_resetDStream tSTD_resetSeqStore tSTD_reset_compressedBlockState tSTD_row_update tSTD_selectBlockCompressor tSTD_selectEncodingType tSTD_seqToCodes tSTD_sizeof_CCtx tSTD_sizeof_CDict tSTD_sizeof_CStream tSTD_sizeof_DCtx tSTD_sizeof_DDict tSTD_sizeof_DStream tSTD_toFlushNow tSTD_updateTree tSTD_versionNumber tSTD_versionString tSTD_writeLastEmptyBlock tSTD_writeSkippableFrame tivbwt tivsufsort t_ZSTD_threading_useless_symbol vcab

Name

.text

Size

742KB

Virtual Size

741KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

428B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

505056.dat.exe

kernel32

msvcrt