sus[.]zip | Triage™

resource
unpack001/c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f.dll
unpack001/f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1.exe

sus.zip

SHA256 13359f410a45b46e21b37640edb1fabe71d44f503425b019406cd4d8e1d15d5d
MD5 6cf19d7eee4ff4da8a79fb8dab15f99e
SHA1 3eb3ab9d77c3d7f090a53901f39763c5982e5873
SHA512 3a2cf7a10d85cf0c89ed2c721c7c7da2c88934ab35bf03e6848b9fc1d2177211e0bd42bc68a0d819999e974e4c22caac95ae51017deba24dd777573a64ef1ba6
SSDEEP 6144:pujyZxTqLQsg6aR54kuBceXEr74grSV17hRQSlneWt2NFnBIyPj:Qe7T96dZXw4g45/QSlefNFnqyr
MD5 SHA1 SHA512 SSDEEP

1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf.ps1

SHA256 1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf
MD5 642f66c6c6b7cfbe0da921ea030df0cb
SHA1 999a425666dad19c246db0775b9cec8d930b40a2
SHA512 d6f26e731d4415ccfae089c713e7865268532ae8a82c1fd75c9228451fdde33b6e4c6c264fdd7cd807ae06b53ad0265bf6034c7c4c51f3db83b323edad9cba42
MD5 SHA1 SHA512

40dd947539ce0ad32b96f9328c11fced3b4ba423103fb2fbd8cd0497f6be61bd.unknown

SHA256 40dd947539ce0ad32b96f9328c11fced3b4ba423103fb2fbd8cd0497f6be61bd
MD5 988b428aa7da930315d2bdac1d7f13f7
SHA1 3fbd69f9611a6c2181f9decb7d62a19d12bf97ee
SHA512 0078fd9e69e2f9e172de2db3dc3d13c1b7fcdebc9ef95783d89f3491b248a87c1f0264afcaaf9c7cac53b8ff10ec4e07057bfe86749010a2092c600cc3e9048f
SSDEEP 768:YNbvbVqraag0YrBHXZUrRhSZOh/q+wjDp8v3uWqeqLhy5:YlDsraDD1HJ+94jDS/XqeqVy5
MD5 SHA1 SHA512 SSDEEP

8f8264c173e6d036e87b706dbb87e3036ae17df32e53a683c87bff94fce2c242.pdf

SHA256 8f8264c173e6d036e87b706dbb87e3036ae17df32e53a683c87bff94fce2c242
MD5 3c218594fe3db33cff5c3d4dc7b5b14c
SHA1 f7c625f1d3581aa9a3fb81bb26c02f17f0a4004e
SHA512 a881a1bb9ad3cbe26f6de6feddac5733a14899f48ae275dbc879e40744c3ee0cdcbcf8223b356b8ad43d02624b606721af855de030c567616f67efa3f177f530
SSDEEP 384:2cSDvX7hWFcTPm/K7Uzzzzzzzzzzzzzzzzz32cm8:2cST7hWGTO/Kr8
MD5 SHA1 SHA512 SSDEEP

a5c406f287b82099796d52cf8edbeec9b6188b3b23b12bf5e2b2b3556c94ec65.exe

SHA256 a5c406f287b82099796d52cf8edbeec9b6188b3b23b12bf5e2b2b3556c94ec65
MD5 c20f7442c6d95afcd1f22cde88418cc5
SHA1 26b849021350124f9ef541767b08a46e02fd0401
SHA512 5322437d061aa20f92b1068e337ec383e1432e826231411ea5c174940cbe6238154df39b3ec7e864c30a1f42a933468588a42e2eb8166e4ebd367aea1fe72fec
SSDEEP 3072:YB82tUdBGMwLBEBNlGlyBgj6Jag3/izWNV+ewE5JswPGIUh8w9U0TMZ:v22zGMSqNsg683/izWn++rUd9U0Tm
MD5 SHA1 SHA512 SSDEEP

b7b62436f18ee4fa5b210d099271976d9a7b02dcce605703358a8c68372de063.elf

SHA256 b7b62436f18ee4fa5b210d099271976d9a7b02dcce605703358a8c68372de063
MD5 b8877fd584233abcb14c948ef9cdf543
SHA1 e82dbda2f45da6817c8b6629e712d27a485375a4
SHA512 bd2d7b0e45149cf456159de7ea5141299afc423680084345ff118832a813659758ce5ca075ea3195724fe8f357aa5bc626cf54f11d948c781685b2d8a2f63b2e
SSDEEP 192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdaOqGM5V6LsDdv4:yb2eX3zAKuiNPZRwwqdv4
MD5 SHA1 SHA512 SSDEEP

linux arm

c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f
MD5 a67b4a881e940f82fe871505f831bf96
SHA1 ffcd7a3a80eb0caf019a6d30297522d49311feec
SHA512 9c33174f4867b1d01c537425a40e3e0d290559d8777e6cc9a9e77a907067ecabeb11fe96322081ce56b381913d24ecce2020dac901bef89fc9fe66e0e28c0742
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f1b2760487007b7db9e7545ee85deafba0e18859d7e43988f2c623cab2793439.exe

SHA256 f1b2760487007b7db9e7545ee85deafba0e18859d7e43988f2c623cab2793439
MD5 15e7b48f42f2f554af59273624a1c963
SHA1 40d258058bd0da133d18eef25c518ee2822bf820
SHA512 401764aacf6383a2402bc52ff86f8d2d330ceb15ae7a9d6cdb6e5d0ce1fe5975ef0aaa7592e98adcaaa2c2959cef7f608a4911af9341f3d21bf9b5a8456aa78d
SSDEEP 3072:Uyc7yw8ntQBkNhSys+LTUUMc5Q0hPjfr1bKMbyAvvvvvvvvvvvvvv0NUFSe+E:Uycuwi7NhsaTUUMc20NzrVKMufu4E
MD5 SHA1 SHA512 SSDEEP

f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1.exe

IMPHASH 5fb55a8cf9e366e92e6438ce6e27e358
SHA256 f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1
MD5 a4f5440b7f44e289fd8d5cc3cc16c359
SHA1 7507fe6c69ac054b3621b3d1df45f5d54a0bd57d
SHA512 38af98b32b18f064aa32ff9cfb59f0446eb29f445e145c1870bc531fa9d829e32a63e262f741c443337e39bd550c4c68b76d235bce0ec783177d9cab73bf03b1
SSDEEP 1536:93L1yHnz19CDUJKLqtABd+wFa2L1swXLCCGX3cH3:93L1O5kwJKWiBkQLTXZGg3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6084

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar ord588 __vbaLenBstr __vbaStrVarMove __vbaLineInputStr __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaFreeObjList ord516 _adj_fprem1 __vbaRecAnsiToUni ord518 ord519 __vbaResume __vbaCopyBytes __vbaStrCat __vbaError __vbaLsetFixstr __vbaSetSystemError __vbaRecDestruct __vbaHresultCheckObj ord558 __vbaLenVar _adj_fdiv_m32 __vbaAryDestruct __vbaLateMemSt ord593 __vbaVarForInit __vbaExitProc __vbaForEachCollObj ord594 ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaFpR4 __vbaBoolVar __vbaStrFixstr ord520 __vbaFpR8 _CIsin ord709 __vbaErase ord631 ord525 ord632 __vbaNextEachCollObj __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaLateIdCallLd __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release ord600 ord601 __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaUI1I4 __vbaExceptHandler ord712 __vbaStrToUnicode __vbaPrintFile ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord716 ord531 __vbaFPException ord717 __vbaInStrVar __vbaGetOwner3 __vbaUbound __vbaStrVarVal __vbaVarCat ord535 __vbaI2Var __vbaLsetFixstrFree ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaVar2Vec __vbaVarLateMemCallLdRf ord570 __vbaNew2 ord648 ord571 _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaStrCopy ord681 __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaAryLock __vbaLateMemCall __vbaVarAdd __vbaStrToAnsi __vbaVarDup __vbaFpI2 __vbaFpI4 ord616 __vbaVarLateMemCallLd __vbaVarCopy ord617 __vbaVarSetObjAddref __vbaLateMemCallLd __vbaR8IntI2 __vbaRecDestructAnsi _CIatan ord618 __vbaAryCopy __vbaStrMove __vbaStrVarCopy ord619 _allmul _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaMidStmtBstr __vbaFreeStr __vbaFreeObj __vbaRecAssign ord581

sus.zip

1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf.ps1

40dd947539ce0ad32b96f9328c11fced3b4ba423103fb2fbd8cd0497f6be61bd.unknown

8f8264c173e6d036e87b706dbb87e3036ae17df32e53a683c87bff94fce2c242.pdf

a5c406f287b82099796d52cf8edbeec9b6188b3b23b12bf5e2b2b3556c94ec65.exe

b7b62436f18ee4fa5b210d099271976d9a7b02dcce605703358a8c68372de063.elf

c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f.dll

mscoree

dotnet

f1b2760487007b7db9e7545ee85deafba0e18859d7e43988f2c623cab2793439.exe

f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1.exe

msvbvm60

generic

Sharing

General

Malware Config

Signatures

File Explorer

sus.zip

1ad4e8a66682dfe74980ee99186517e25a81bd2bf00aafbbafbadc3a63cdd4bf.ps1

40dd947539ce0ad32b96f9328c11fced3b4ba423103fb2fbd8cd0497f6be61bd.unknown

8f8264c173e6d036e87b706dbb87e3036ae17df32e53a683c87bff94fce2c242.pdf

a5c406f287b82099796d52cf8edbeec9b6188b3b23b12bf5e2b2b3556c94ec65.exe

b7b62436f18ee4fa5b210d099271976d9a7b02dcce605703358a8c68372de063.elf

c897c784626cb3d7748dc94bf3401205aa785efcef10a1e5534def1ab68a2f6f.dll

mscoree

dotnet

f1b2760487007b7db9e7545ee85deafba0e18859d7e43988f2c623cab2793439.exe

f28ca289207dfe7c79f3eca130f2a340bbc260c9818b5f5d7b94a3304a9fd4b1.exe

msvbvm60

generic