07f384339dd2333a6dd89b56deb1dd13
- SHA256 2fd3c770bdee0f5366bea593f5215cfc10c2642278e91bd7a0eae247d32930a4
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HotFix.exe.lnk
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
HotFix.exe.lnk
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Osmanlı Bot.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
Osmanlı Bot.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 07f384339dd2333a6dd89b56deb1dd13
- Size 1.2MB
- Sample231230-ac3plsdedl
- SHA256 2fd3c770bdee0f5366bea593f5215cfc10c2642278e91bd7a0eae247d32930a4
- MD5 07f384339dd2333a6dd89b56deb1dd13
- SHA1 ac9e95d17bb1b5d208c47c485e1fdb5d93ef0c7e
- SHA512 846a8f1f0151374dd5d86fcfd8d8402eb3970a36b3225b2f1c70a3a1505b89fd7010f1ec6baa7e6b540832e88ffbb6b2a5ccd839b4bdcb7392a06496b8c454f8
- SSDEEP 24576:5KEfKOjQTdTjN06FOZ9cyZHy2dfimRce5HTrI4XS29lKjX:5KEiO8TF1LGy2FimKe5HT+2/KjX
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Osmanlı Bot.exe
File Explorer
-
07f384339dd2333a6dd89b56deb1dd13.rar 1.2MB
-
HotFix.exe.lnk.lnk 640B
-
Kesinlikle oku yoksa kuramazsın.txt205B
-
Osmanlı Bot.exe.exe 1.3MB
HotFix.exe.lnk
- SHA256 7a0ffced07fbe5824c74ebbf09b7cb288657cc801a751423420a7d7671df7474
- MD5 8ddf7a8cde3dab39ebd22a4613d63423
- SHA1 6629bb61d341100b7f083e9142d90b41a66ca8d1
- SHA512 5896379c928d19c5f497e5c5ba8e2f8cdff2c44e5f15d878d19144ff5b21f338a701919b0e11ec99cbbd341ed8aef639131bd9904f713fc66c89a2f0d88cb0c6
- MD5 SHA1 SHA512
Kesinlikle oku yoksa kuramazsın.txt
- SHA256 f1048780b9902ba23c9676e598c7d02ba12311507da23a314fd0746b7dc194b3
- MD5 e0fca2035e95cfc55911002312f491a2
- SHA1 cde1865bd18e1f7b30aae11a532e00ffbe6651cc
- SHA512 f4d18c13e1d597eb9a32e4719163c39219f07c52eace4f2a6ca3009388085727cb0dde8040d87b3fb235b36607f6c734037cf085725bb50dad811b7b1dcf7f85
- MD5 SHA1 SHA512
Osmanlı Bot.exe
- IMPHASH a3ceb216829cf83d842dc13aff40afe5
- SHA256 c45d51e25dc9bd378e997a242c0e0b8dc3f0bac67fe8d12cd5d18f7786e8ccc4
- MD5 fe010d3bbb86067e66f3233bbbe6cbdb
- SHA1 2b151b91a955d32a4d68b2a90586c741e09d28fc
- SHA512 8bf65b5672da1c63dac4f2dd19e6001bc78536f920b529fc420cf4584665098d80c1da26b47ebd5c4e7e6010419d90d4c6a822df51d8783b98dfde76d870818b
- SSDEEP 24576:CzwTT6O/SmlZ547pkSOG/hqemVh9ruez8cm8Lzw+0nXCaOQxMfN92Q6QAf:Cz+TRidOGJZm8Lc++0nSa7xG92Q6QA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
8320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateFileW
GetProcAddress
CloseHandle
GetWindowsDirectoryW
LocalFree
lstrcpyW
GetLastError
HeapFree
HeapAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
GetModuleFileNameW
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
LoadLibraryW
GetSystemDirectoryW
GetModuleHandleW
CreateDirectoryW
TlsSetValue
FreeLibrary
user32
SendMessageW
FindWindowW
shlwapi
PathFileExistsW
PathRemoveFileSpecW
StrCpyW
advapi32
AllocateAndInitializeSid
SetSecurityInfo
SetEntriesInAclW
FreeSid
GetSecurityInfo
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=91, id=1, productName=Unmarked objects,
count=25, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=83, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,