4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.zip
Size 1.8MB
Sample240402-l2gn8aeb74
SHA256 05dc25ab693f8dd4de2070840c58c43fa567a16dce0c718c39e22138e1befc59
MD5 183b375bd3a32289f6f1c64b99d8ed56
SHA1 e06ef9f4253fc0989cc248b7f35ed87ad93584d4
SHA512 b4d004d9c9be7fdb79108beed6fdf630f1c2feba4165fac2a6efedb3e2ce6c5ab9ea627fb4de241dcf118c40b18d9c335eb68b40e796bed93d4aca4ae83f7f13
SSDEEP 24576:lcS8PJtC0mDo3KBFeCXrHhVC4y073vakpwr67Az2hGL2RnGwHyZoO4rdocQzD5j8:QDCDHeBySkpwr6+2hG6FG1ZT/pQI03ci
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe

File Explorer

4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.zip

.zip 1.8MB
4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe

.exe 1.8MB

4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.zip

SHA256 05dc25ab693f8dd4de2070840c58c43fa567a16dce0c718c39e22138e1befc59
MD5 183b375bd3a32289f6f1c64b99d8ed56
SHA1 e06ef9f4253fc0989cc248b7f35ed87ad93584d4
SHA512 b4d004d9c9be7fdb79108beed6fdf630f1c2feba4165fac2a6efedb3e2ce6c5ab9ea627fb4de241dcf118c40b18d9c335eb68b40e796bed93d4aca4ae83f7f13
SSDEEP 24576:lcS8PJtC0mDo3KBFeCXrHhVC4y073vakpwr67Az2hGL2RnGwHyZoO4rdocQzD5j8:QDCDHeBySkpwr6+2hG6FG1ZT/pQI03ci
MD5 SHA1 SHA512 SSDEEP

Password

infected

4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe

IMPHASH 2eabe9054cad5152567f0699947a2c5b
SHA256 4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7
MD5 b0760925b1a75ecc31de3a751527f22e
SHA1 94cf73fb3e18054e1bae184e56be5f3e6331ccc3
SHA512 5dadb7fab6cacf74c574dc3455a57a2a48f0cd27cc6aef25b32cacf23a873050554c528eb3789daf2b6e1968acf9aad254cd00549c16f40e7412acb1c5a57f10
SSDEEP 49152:g4f/xxV0vXV7zSUfjVfWkC9cZD5pHARh0RoASjOBQX:gcxxCxPi9cN60RRoiQX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

4927488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

186KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

wcagcaic

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

klffmwsh

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.taggant

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.zip

4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe

kernel32

generic