b7e5c0c9e1a93e8c74c2e677afc67899
- SHA256 f271c8f134130fbfe0655f50ebf35d421d0dde39371d8f89816e736e447f5689
Behavioral task
behavioral1
Sample
MHPT v7 Injector.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
MHPT v7 Injector.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
MHPT v7.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
MHPT v7.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target b7e5c0c9e1a93e8c74c2e677afc67899
- Size 904KB
- Sample240306-vcx5cach37
- SHA256 f271c8f134130fbfe0655f50ebf35d421d0dde39371d8f89816e736e447f5689
- MD5 b7e5c0c9e1a93e8c74c2e677afc67899
- SHA1 a90cd439799a8732ce7aa983d1aaaea569209ef4
- SHA512 82a7ad1d64eda05408c601ed2052a906b0a710682dd840ef66d4530d170bfa40c4b9a501770ec8b5f5f421f6742313af468b74b7b90a131d7c7f333715e0e08c
- SSDEEP 24576:xOxYDvXy3nEpZBPuVKnrJwmsXwBieGiQFts:Ay0if6rXwBlQFts
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/MHPT v7.dll aspack_v212_v242 - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/MHPT v7 Injector.exe unpack001/MHPT v7.dll
File Explorer
-
b7e5c0c9e1a93e8c74c2e677afc67899.rar 904KB
-
MHPT v7 Injector.exe.exe 982KB
-
MHPT v7.dll.dll 7KB
MHPT v7 Injector.exe
- IMPHASH baa93d47220682c04d92f7797d9224ce
- SHA256 17e33d0df88ff540b77c81b73947a9dc311abedd625df1ed5816212cba47a19d
- MD5 b29abaf19505a62664666efd73df99e3
- SHA1 e5059b700badfdda391be5596fa0331bff589a91
- SHA512 76ac2ca0a4c9966ac206f9ba1642d17db5ac6987df814f40e35afa34e19b2cccf4fd57e884b88ce2c23f54670fee1b911eac7edc0bcb5915991f11625089d263
- SSDEEP 24576:M2RTaadusUHHSAutT1HLeuEfwBwaPT9aOuzA1W:MWTBusUHH/utRerwPT9fun
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2117632
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
lstrcpy
comctl32
InitCommonControls
Name
Size
178KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.crypt
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.crypt
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
816KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
ytmvfyqu
Size
743KB
Virtual Size
744KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
apgnfbuy
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
MHPT v7.dll
- SHA256 1a8e59105734c4f157b07c16b4f3cf08e1c5a83554b5e76ed7257544a4aec2a4
- MD5 b4cbe3a1aaaf0647b101f3eea0704ab5
- SHA1 5f772764f18a3a96e6a81ebd75c741a7ad263ff9
- SHA512 c4a319d29520fd6145fa4f591792c4e4ecf97f2e7f8c986273f2545163b7c59910c4802fa24032560c01abd0d5599205bda9ca3cf72a522c14c249fe69d747e3
- SSDEEP 192:I0nPXNWAxgwCMrpY7S8LqPZo5LdCfuR1nuO3:IDAxgr6+S9Pfu7n5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20481
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Hack
Name
.text
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=18, version=8444,
count=5, id=19, version=8078,