7502a56e6ccb479478fffebccc393b25
- SHA256 28d89d3ff77afd3b3b895bde76eb31e9c8eb0b31b0086be1b6e42b9d47a06573
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
nt6 yukleyici.exe
Resource
win7-20231215-en
windows7-x64
18 signatures
150 seconds
General
- Target 7502a56e6ccb479478fffebccc393b25
- Size 745KB
- Sample240125-vb6ebsbhaq
- SHA256 28d89d3ff77afd3b3b895bde76eb31e9c8eb0b31b0086be1b6e42b9d47a06573
- MD5 7502a56e6ccb479478fffebccc393b25
- SHA1 590ae6354a7032151c34374e9d840529c1127be6
- SHA512 ca109fcfa7f0db9d0bc66bc6ef5c49fbab8a864044832f341de382b9a7b3f9c5d353214c6f67d4b17f3487c5631ce4eb723241080f7bd160e55f89902fb4e566
- SSDEEP 12288:S8/0K9CwahiCBRP948cfSI/jzM5itPr9YNa/ySwbZkJYE6qN0TkPIF16PrVy7j+w:S8/1C79Bd9LcfHQ8tGQhkZkeqN0ik6zg
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/nt6 yukleyici.exe
File Explorer
-
7502a56e6ccb479478fffebccc393b25.rar 745KB
-
nt6 yukleyici.exe.exe 798KB
nt6 yukleyici.exe
- IMPHASH 2339ac77bf9371500ebbf86df3a10d43
- SHA256 7bd8509f843d3c8ca7ac1c5ca424e1e6c24338a21c4f16320bd28c3a88b32e0d
- MD5 772ce69525c66971108aa830e22b121e
- SHA1 51edeb4c73512adb45d9bbf3af91c915c739ed7d
- SHA512 bd68617e4a0328cd62521299eb10196bbc72727b289da811ac7a30f699bfbdaebd2021589a4a6be347e44d933325cfcd54ec710c63d720410d36ffab54820a6e
- SSDEEP 12288:lLoyy90pfcQXCq8KWNpQhvYhNEvYDXUL13tFieXmsv1xtbJNSoUl0AZj:1yiCq8+Ez7MNtwuvvBJNSl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
27384
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
kernel32
LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
lstrlenA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
GetModuleFileNameA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
ExpandEnvironmentStringsA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
CompareStringA
GetVersion
GetModuleHandleW
FreeResource
LockResource
LoadResource
SizeofResource
CloseHandle
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
SetCurrentDirectoryA
GetTempFileNameA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
ExitProcess
LoadLibraryExA
GetVersionExA
GetExitCodeProcess
GetProcAddress
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
FindResourceA
LoadLibraryA
FreeLibrary
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
RtlUnwind
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
EnumResourceLanguagesA
MulDiv
GetDiskFreeSpaceA
WaitForSingleObject
gdi32
GetDeviceCaps
user32
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
GetDC
ReleaseDC
SetWindowPos
SendMessageA
PeekMessageA
MsgWaitForMultipleObjects
DispatchMessageA
CallWindowProcA
GetWindowLongA
SetWindowLongA
CharPrevA
CharUpperA
CharNextA
ExitWindowsEx
EndDialog
GetDesktopWindow
LoadStringA
SetDlgItemTextA
MessageBeep
GetWindowRect
GetSystemMetrics
msvcrt
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
__getmainargs
memcpy
memset
_vsnprintf
comctl32
ord17
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
749KB
Virtual Size
752KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=214, id=1, productName=Unmarked objects,
count=94, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,