aebf64159ae48037d8a2760a291df93f
- SHA256 a0a2c1bcf4275e486c1c385eda0ecf58718f52061d29bea7192f0a2af3005709
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
- Target aebf64159ae48037d8a2760a291df93f
- Size 95KB
- Sample240229-rw458acd77
- SHA256 a0a2c1bcf4275e486c1c385eda0ecf58718f52061d29bea7192f0a2af3005709
- MD5 aebf64159ae48037d8a2760a291df93f
- SHA1 4f40b00f26420bbcb6b6966b257db00c7e29d4ad
- SHA512 0a5ba4006d6e94f1663ee3dbf66b2cdbfbe85973b53ef4de88bed08b49d9da7eebf47eedb0438b8de47628f0ca05eacd6e5635cb4838a314cc4b8c39b73bb63b
- SSDEEP 1536:kgxBlDdE8gaVncuTrPzZSj+/4+Ff2f7gR8sOBUep2w7T1YJGvj2u8MQN6YZgy57H:U8Z1j47ga95f/L/8iYWFJW9
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614
File Explorer
-
aebf64159ae48037d8a2760a291df93f.zip 95KB
-
e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614.dll 168KB
e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614
- IMPHASH b5b22dfae1a1ccf696c4aff6f4bd90f7
- SHA256 e298ef044baada7fadb47e9b722197896b4dafa18313de9a40bf96755148e614
- MD5 d5ce57c496199a940b18facab5968b72
- SHA1 e759b9c9ec46e65e5c4790d45f833da0ee327b64
- SHA512 fca0e9da6752257d7de464f580a5b59690f6f66dd0f17cc1f66ab926577d2cc0e61e80a5c163dcc652069fea2bc1f7c4fe40655cc5f442d58f3125dee77b7466
- SSDEEP 3072:F+ymPQ38mtBMzgxpvvdoZpSjXfW8Pzkfg:FcQ38AxpOZEzO8bj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
77670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\millionbat\eightObserve\ShowLight\Circlesell\base.pdb
kernel32
FindFirstChangeNotificationW
TlsGetValue
GetCPInfo
GetSystemTimeAsFileTime
Sleep
SetSystemPowerState
GetModuleFileNameW
VirtualProtectEx
RemoveDirectoryW
TlsAlloc
CloseHandle
GetLastError
HeapFree
HeapAlloc
EncodePointer
DecodePointer
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
SetLastError
MultiByteToWideChar
GetProcessHeap
ExitProcess
GetModuleHandleExW
GetProcAddress
WideCharToMultiByte
GetStdHandle
WriteFile
HeapSize
GetTimeZoneInformation
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
CompareStringW
LCMapStringW
LoadLibraryExW
OutputDebugStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetEnvironmentVariableA
SetStdHandle
SetFilePointerEx
WriteConsoleW
CreateFileW
DllRegisterServer
DllUnregisterServer
Name
.text
Size
147KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
392KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=27, id=223, productName=VS2013 build 21005, version=21005,
count=126, id=224, productName=VS2013 build 21005, version=21005,
count=46, id=225, productName=VS2013 build 21005, version=21005,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=82, id=1, productName=Unmarked objects,
count=1, id=229, version=30723,
count=1, id=220, productName=VS2013 UPD3 build 30723, version=30723,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,