eb234ba5cceaf5c22e7d59c0d5d6cda995da1129188f47a1c44523ab94f3cb58[.]zip

General

Target
eb234ba5cceaf5c22e7d59c0d5d6cda995da1129188f47a1c44523ab94f3cb58.zip
Size 185KB
Sample240402-msnxlsfe8v
SHA256 e49a1567c96e8aad2f8d72f91f00d236f2d6f18b8f02d8e45f84e4e1c4f1ee9c
MD5 9986d63fcf7d252c4e1b6c12e81fb4fa
SHA1 1b828b84157a5078ab24d74ba58ca4c4a3520f4b
SHA512 0eb5b77bcfa54e78041330a970885619507b41e3e5dcbd559e1706ec196a53f0c57028460efeb25a1816eb05440e9cd2b9d74b384a9876de4e54f014213f4d1f
SSDEEP 3072:Q23QK/+18AcAUb+r+5Pmp/kcfuxW+HkolY/R8Pp628+CwbNlr+OiGcaYDO0HrXOO:Tx2Pq0w+p/keuxlEeI2VgGcDDpZY1D5Q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/eb234ba5cceaf5c22e7d59c0d5d6cda995da1129188f47a1c44523ab94f3cb58.exe

File Explorer

eb234ba5cceaf5c22e7d59c0d5d6cda995da1129188f47a1c44523ab94f3cb58.zip

.zip 185KB
eb234ba5cceaf5c22e7d59c0d5d6cda995da1129188f47a1c44523ab94f3cb58.exe

.exe 334KB

eb234ba5cceaf5c22e7d59c0d5d6cda995da1129188f47a1c44523ab94f3cb58.zip

SHA256 e49a1567c96e8aad2f8d72f91f00d236f2d6f18b8f02d8e45f84e4e1c4f1ee9c
MD5 9986d63fcf7d252c4e1b6c12e81fb4fa
SHA1 1b828b84157a5078ab24d74ba58ca4c4a3520f4b
SHA512 0eb5b77bcfa54e78041330a970885619507b41e3e5dcbd559e1706ec196a53f0c57028460efeb25a1816eb05440e9cd2b9d74b384a9876de4e54f014213f4d1f
SSDEEP 3072:Q23QK/+18AcAUb+r+5Pmp/kcfuxW+HkolY/R8Pp628+CwbNlr+OiGcaYDO0HrXOO:Tx2Pq0w+p/keuxlEeI2VgGcDDpZY1D5Q
MD5 SHA1 SHA512 SSDEEP

Password

infected

eb234ba5cceaf5c22e7d59c0d5d6cda995da1129188f47a1c44523ab94f3cb58.exe

IMPHASH 83f60ac3c0aa9a7a804ae19989ee18ed
SHA256 eb234ba5cceaf5c22e7d59c0d5d6cda995da1129188f47a1c44523ab94f3cb58
MD5 b90fc46ee52b60b44e0b552a310f5818
SHA1 a75f11b9998886974f84822d78c6e35dbe5dc1d3
SHA512 705c5dd2d8f0da0c0344d3b3c9df0096b333bd2b471cba5f30263bde77bcd2e8adc14049b54756dce6df5271c2ab4e5dcf889eb12689774e723d69bdf40d8c10
SSDEEP 3072:IzMuGzE5XDNJmvXE6m+VUPIiXUJXKu14umGZYnqlYbUecdDMkmz93iKojUwrCTz6:IzMumMfUtcuCjQMkG98bmm2xTF2F
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

15974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\yapaco-busaviyenuc_vahabujabesoli\rik.pdb

kernel32

InterlockedIncrement SetConsoleTextAttribute ReadConsoleA GetCurrentProcess CreateDirectoryW GetFileAttributesExA GetTickCount GetCommConfig GetWindowsDirectoryA GlobalAlloc GetVolumeInformationA GetFirmwareEnvironmentVariableA TerminateThread GetLocaleInfoW GetConsoleAliasExesLengthW GetVersionExW GetConsoleAliasW SetSystemPowerState GetModuleFileNameW CreateFileW GetHandleInformation FindResourceA GetCurrentDirectoryW GetProcAddress PeekConsoleInputW RemoveDirectoryA LoadLibraryA WriteConsoleA FindFirstVolumeMountPointW GetNumberFormatW QueryDosDeviceW GlobalFindAtomW VirtualProtect _lopen GetCurrentProcessId ResetWriteWatch AreFileApisANSI OutputDebugStringW HeapReAlloc LoadLibraryExW GetLastError GetEnvironmentVariableW MultiByteToWideChar EncodePointer DecodePointer ReadFile GetCommandLineA RaiseException RtlUnwind IsProcessorFeaturePresent IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FlushFileBuffers WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode DeleteCriticalSection ExitProcess GetModuleHandleExW HeapSize HeapFree IsDebuggerPresent SetFilePointerEx GetStdHandle GetFileType GetStartupInfoW HeapAlloc GetProcessHeap GetModuleFileNameA QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetStringTypeW LCMapStringW SetStdHandle WriteConsoleW CloseHandle

user32

CharUpperBuffW ChangeMenuA CharLowerA DrawAnimatedRects

advapi32

ReadEventLogA

Sharing