6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421[.]zip

Target
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.zip
Size 4.2MB
Sample240403-xpdbtaac35
SHA256 7cd975ad9527659ded0174215814798afbbe615dfe5012b9def89e9d9f2bcbd5
MD5 7e32e5302b4bb8c73acad0f9d1733e40
SHA1 c8f0463bf13e431c5801785abd8beeaa04bd3b78
SHA512 2b23382528848828872322d988fa6210ab02e8c970f61e608da0682fe11d85665a78852cdedf058242d4d5883bd467d864ba81e854baabfbff1f221ddda3a2f6
SSDEEP 98304:32X95deLTqs4NowML3II7nsSOAzgrq5O62Aq1muFww8:3o9X8qsSgMInZOAzgrqs6M0Nr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe

File Explorer

6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.zip

.zip 4.2MB
6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe

.exe 4.5MB

6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.zip

SHA256 7cd975ad9527659ded0174215814798afbbe615dfe5012b9def89e9d9f2bcbd5
MD5 7e32e5302b4bb8c73acad0f9d1733e40
SHA1 c8f0463bf13e431c5801785abd8beeaa04bd3b78
SHA512 2b23382528848828872322d988fa6210ab02e8c970f61e608da0682fe11d85665a78852cdedf058242d4d5883bd467d864ba81e854baabfbff1f221ddda3a2f6
SSDEEP 98304:32X95deLTqs4NowML3II7nsSOAzgrq5O62Aq1muFww8:3o9X8qsSgMInZOAzgrqs6M0Nr
MD5 SHA1 SHA512 SSDEEP

Password

infected

6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe

IMPHASH 78c55915f8ede852a41ddcfd991a23b4
SHA256 6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421
MD5 20ed8b8eb556fa3cbc88b83882a6f1b0
SHA1 cd7ce6fc0068b6ef9c37d5dafec1319a39b88709
SHA512 868b859bdff27e41f63b527590214ad22dcaf332bb3d5c7daafd295ea648d71d5bd6d01fee29587eee8b7d4ef01384089eb0b2408f3d2e048021701c357e3b9b
SSDEEP 98304:in1GhDYSAEbWAtdt7Eea0+JJHOBMT6yCltq5CFvxWof8e45D4UO38cYd5:0gYfux7EF0CHqI6Xg5CFvxW2Pe
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

6226880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp7Dÿ

Size

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmpTDÿ

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmpADÿ

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

129KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.zip

6be4950d9a919f5d0150d19552b340e9b5ef1959a18fd97b18778bf39e1a6421.exe

kernel32

user32

advapi32

shell32

ole32

generic