markov_small[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
markov_small.7z
Size 161KB
Sample230905-ea4lcach7t
SHA256 ea12af0b71bfa241c4430a06ddcfa129be2f314491e304c8879875e54c736e69
MD5 d0e1b2ed456c55c5e77e4cb6cc651991
SHA1 bce4a573dd751d129659dbaca464fdb0638c62b8
SHA512 c85bd898345153b5999e9a7e10650ea48549a4c730744f41fdbc6aa845dcc3106aca961ea0aeaf8f7f106a64e43857313323f4ad573611d43e7d0f5cafaec5c3
SSDEEP 3072:cS2Dlz+gyPhrIhvrapb+HToTtzg1V4vuVrIfpIZL6Fk2e9LuJkUas2j/:cSalhyPkQ+sTtzgQv+rIhTEpurU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/markov_small.exe

File Explorer

markov_small.7z

.7z 161KB
markov_small.exe

.exe 193KB
payload.bin

100KB

markov_small.7z

SHA256 ea12af0b71bfa241c4430a06ddcfa129be2f314491e304c8879875e54c736e69
MD5 d0e1b2ed456c55c5e77e4cb6cc651991
SHA1 bce4a573dd751d129659dbaca464fdb0638c62b8
SHA512 c85bd898345153b5999e9a7e10650ea48549a4c730744f41fdbc6aa845dcc3106aca961ea0aeaf8f7f106a64e43857313323f4ad573611d43e7d0f5cafaec5c3
SSDEEP 3072:cS2Dlz+gyPhrIhvrapb+HToTtzg1V4vuVrIfpIZL6Fk2e9LuJkUas2j/:cSalhyPkQ+sTtzgQv+rIhTEpurU
MD5 SHA1 SHA512 SSDEEP

markov_small.exe

IMPHASH 36fe9e533e2addc9b2537fc41997c132
SHA256 6813c99d910053cfa4ee065e0541a3230a9592dc6b2374ac2ff6f0ec99a3c364
MD5 5f1aaf21e75572528618ac472264dcc3
SHA1 fc011482338f2410df43ada061d49f4f6a497801
SHA512 170a56bc8beee33a7c10e6a5845167012edd0e0bd95c604ab08690e94dea53595eb50634dc348173aed0bc164b24804f9a79c864fe43342ba120d687a4830349
SSDEEP 3072:n7WTOWDBkvTf5oEkrR187sEZcGxvjinOZ+U9LlmoGMMOkPRCEpZp3:n7WTOWoTf0j87MGxvwMlpjUPpZd
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

140368

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcessId WaitForSingleObject TryAcquireSRWLockExclusive QueryPerformanceCounter HeapAlloc GetProcessHeap HeapFree HeapReAlloc AcquireSRWLockShared WaitForSingleObjectEx LoadLibraryA CreateMutexA GetModuleHandleA GetCommandLineW GetStdHandle GetFileInformationByHandleEx RtlVirtualUnwind InitializeSListHead GetConsoleMode GetEnvironmentVariableW GetModuleHandleW FormatMessageW GetModuleFileNameW ExitProcess GetFullPathNameW GetFileInformationByHandle GetCurrentDirectoryW MultiByteToWideChar WriteConsoleW TlsGetValue TlsSetValue GetSystemTimeAsFileTime SetLastError RtlLookupFunctionEntry GetProcAddress RtlCaptureContext GetCurrentThread GetCurrentThreadId GetCurrentProcess AcquireSRWLockExclusive SetThreadStackGuarantee AddVectoredExceptionHandler GetLastError ReleaseSRWLockShared ReleaseMutex IsDebuggerPresent UnhandledExceptionFilter CloseHandle ReleaseSRWLockExclusive SetUnhandledExceptionFilter VirtualFree CreateFileW VirtualAlloc IsProcessorFeaturePresent

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile

vcruntime140

__CxxFrameHandler3 memcmp memset memmove _CxxThrowException __current_exception_context __current_exception memcpy __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _initterm _exit exit _initialize_onexit_table _initialize_narrow_environment _register_onexit_function _crt_atexit terminate _configure_narrow_argv _set_app_type _initterm_e _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode