b77235f85d6c66f80ca36c9b01e82ead
- SHA256 76928451ea77097ad6f96fda0ee51be9430aa4537b29b853757e76f6ffe8f912
Behavioral task
behavioral1
Sample
Code5.de.url
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Code5.de.url
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Play.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Play.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
bdupd1+4tr.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
bdupd1+4tr.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target b77235f85d6c66f80ca36c9b01e82ead
- Size 1.2MB
- Sample240306-p4mvssbb6w
- SHA256 76928451ea77097ad6f96fda0ee51be9430aa4537b29b853757e76f6ffe8f912
- MD5 b77235f85d6c66f80ca36c9b01e82ead
- SHA1 1ca63a358c27e1de5167105a1ffb87f61c90db69
- SHA512 1bda326ee7e128e199f88343719d2e52e8d0ccaccf3ea049f996ed9d6a95c097ccef758258fb2b70f78ec16d35740f75f656dff65c263463528a7100880cecf4
- SSDEEP 24576:6nIzhZQj6qiwZyLownEN+fWIu4aDmjZ0vmuaXxlOwYbhwBl2Qrif9N/e0ZC:6nJso+uQaDMomjh9Bl2Jf9N/ed
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/bdupd1+4tr.exe aspack_v212_v242 - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Play.dll unpack001/bdupd1+4tr.exe
File Explorer
-
b77235f85d6c66f80ca36c9b01e82ead.zip 1.2MB
-
Code5.de.url184B
-
Play.dll.dll 35KB
-
bdupd1+4tr.exe.exe 1.4MB
-
code5.nfo1KB
-
sILeNt heLLsCrEAm.nfo9KB
Code5.de.url
- SHA256 0f0d83c5fbcf1b4e5e0bc51c7e22da25cea1ce686d82697794190099e419e44c
- MD5 3ac5958df4f92691f0abf2d665916c28
- SHA1 6b2a41d18dc26096d0ff6f87b3c73f86b3e3dd07
- SHA512 1d6fe688c4c103e6e1be4e98ddd21b1bc448e1fedcc4b57c996a62739e02451e4bb8a250766f98a5d161aee9fa8218b1cbd960352ed76d7c269ca9cf9ce87924
- MD5 SHA1 SHA512
Play.dll
- SHA256 c880e5075dbb5c7ddbe069f2df38a26073acaee2ad77dd74eb4f98d6ebfc21d5
- MD5 55761ae5528ca8a0a377a68112bb1154
- SHA1 dcffb53ce66ba6ee478e7d71aa1f0e9df12a9901
- SHA512 c60adccd6e0a250ef82a6018c7193516c9818b848d7c6ca225a2540cb274561eb8940cef8571005bfcc9868241c9768ac1465ea6283450c63b0a444b3f582d76
- SSDEEP 768:UT59z8PmIsX9mZKyQb62I5xzIGeDpzoTm/ct8tfq+G8D2:Uz8P1sUZKyj5xsGeDpzoCuafq+GL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14076
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
V2mGetTime
V2mIsPlay
V2mPlayFile
V2mPlayResource
V2mPlayStream
V2mSetAutoRepeat
V2mStop
V2mTotalTime
Name
CODE
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
21KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
243B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
708B
Virtual Size
708B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bdupd1+4tr.exe
- SHA256 a2d3bae8074a629be6005e05ce4a40328b1b387ddf83eff8cd62c1968f58615a
- MD5 2d7db64704769928b105098b70a6a304
- SHA1 5ea90ea2ddf3add4221f34eeda2d14f8ab7f7529
- SHA512 e64722c4b180d9536aebf18fd8e789163d97dfd4574ec6f5c2208e3f95446bfb5d192b387393e686ed309986f56e99c247038c1ab563087ca79103ae8c52a780
- SSDEEP 24576:/QB6OcwZ2LognEacaHm4aR2Yk/a/YvfwUZt7P6QjiUKn2e:OuDHXaR2Yk/aGl7P6tUKn2e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4501505
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
526KB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.itext
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
34KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
544KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
624KB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.heLL
Size
271KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
code5.nfo
- SHA256 34cb9736bae78360b5f419eab077b1f055045cc3d91b37deeb1813a1025f7573
- MD5 f2e8fc463ac9eed32af721ac7ae56324
- SHA1 4519145ec21828511f66df5f9d593ea69d000b83
- SHA512 59dfa2ca8a36e50b16a054d8d4856d218c8f259d53ba2a718cbdc8c75f17e740e0fe402c19463af61b2a887c08bd748e3b56a2a476c7035473e919dbf512e1c5
- MD5 SHA1 SHA512
sILeNt heLLsCrEAm.nfo
- SHA256 98b7fc35f7600217b69519ead0f8e91bf1abd8ed99356fe540c0f82142d971dc
- MD5 bc02b7a654d6845d43af2e0751b3a390
- SHA1 07f1cc6af38e3437cae29b2bcb2d81e59edafaff
- SHA512 f02fada384c5dfd74c9cf0631b1884566b160381a4ae312693f448160efecc6c2c71dd5280d38f0843c78da11be712d43720b0277a442fce2b5b610b37a03c91
- SSDEEP 96:enSOgVakrKmvN3GPUJ/oTumYolP77DeSD:+SO4J/oTFlPnCSD
- MD5 SHA1 SHA512 SSDEEP