f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5.zip
Size 6.2MB
Sample240403-xnf2baab66
SHA256 460ceb77a4223f66d3dc9778fd0aed6895080a9d036bc62385faa28970bd88db
MD5 0de93d475d532b98f68125b72885cf64
SHA1 b725e26336947766ab51b49626b94166afcb1f7c
SHA512 40ca5db5d5a6c3d55b36bcec67bdf738fdf312708f54518b06d4995ae260b9eb58c6d46dd37a88607b7176f12fb1c08a77ddd20c52a3345cd1a960862b9a0bec
SSDEEP 196608:YtRRp2p7hNldsaC/AXJBQLnUKbXbLqWZbG:YtRRaNsaDZBQTUMdbG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5.exe

File Explorer

f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5.zip

.zip 6.2MB
f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5.exe

.exe 6.3MB

f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5.zip

SHA256 460ceb77a4223f66d3dc9778fd0aed6895080a9d036bc62385faa28970bd88db
MD5 0de93d475d532b98f68125b72885cf64
SHA1 b725e26336947766ab51b49626b94166afcb1f7c
SHA512 40ca5db5d5a6c3d55b36bcec67bdf738fdf312708f54518b06d4995ae260b9eb58c6d46dd37a88607b7176f12fb1c08a77ddd20c52a3345cd1a960862b9a0bec
SSDEEP 196608:YtRRp2p7hNldsaC/AXJBQLnUKbXbLqWZbG:YtRRaNsaDZBQTUMdbG
MD5 SHA1 SHA512 SSDEEP

Password

infected

f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5.exe

IMPHASH 7649bdb702869dd598eb0596dc791dc2
SHA256 f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5
MD5 bf29c3b63c4ccbe13b992c38fe77db84
SHA1 6385948b1c651a32990ecf2e2c166c9b1e705015
SHA512 70f1cb7a16f314cc90857e5f0445b5af264a9cbd5155d868447868fcc126d0d3ab6f5fe1463ca0e82182911a3b8c380e8f359960597e7f60e12da255f7e3aa64
SSDEEP 98304:+D2NOkE9wr+8chcv917VH1viCEYbX5UyEZzDU8PN8osaFuUGKXrfgLQWshVmto9F:yHkEWWu917J1iqJUx1QriNHJP7bF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

8740363

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.MZ5120

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.MZ5121

Size

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp]¬P

Size

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp]¬P

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp]¬P

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

802B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5.zip

f97eb624788a376bcc46df06bff907932ff8cb15b7229c7192bec4a1cd8079c5.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

crypt32

shlwapi

gdiplus

setupapi

ntdll

rstrtmgr

generic