6fb0201dac82a2b6f3c409d74005eb50aab93abd7508f513636be051db86eefd[.]zip

General

Target
6fb0201dac82a2b6f3c409d74005eb50aab93abd7508f513636be051db86eefd.zip
Size 98KB
Sample240403-xpdmksac36
SHA256 5c4a90c16be6f49c88c34a4e95338197fd970f706f83b61bfd24f4b2cc5103b7
MD5 28e44b985e1934a5222a41dc14f0e404
SHA1 f28e26c79f1822cf0c4d69a8be540ac61b4a7013
SHA512 eece34b42aa17dc8933c8572fedd71d9c1e84d2daadadc9b498a809634e8255ddd6bdce96a56bc4aa174b6691247412a68aaec645466646ee28ccbfd60d30a5f
SSDEEP 3072:8T9QGRzN9V5zNUsJ8iWWsSuWZXiC01/i6vnN1vOkh9Qwyp+:8pQGRzN9VdNU48RWsRWZ4i6vjAwyp+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6fb0201dac82a2b6f3c409d74005eb50aab93abd7508f513636be051db86eefd.exe

File Explorer

6fb0201dac82a2b6f3c409d74005eb50aab93abd7508f513636be051db86eefd.zip

.zip 98KB
6fb0201dac82a2b6f3c409d74005eb50aab93abd7508f513636be051db86eefd.exe

.exe 170KB

6fb0201dac82a2b6f3c409d74005eb50aab93abd7508f513636be051db86eefd.zip

SHA256 5c4a90c16be6f49c88c34a4e95338197fd970f706f83b61bfd24f4b2cc5103b7
MD5 28e44b985e1934a5222a41dc14f0e404
SHA1 f28e26c79f1822cf0c4d69a8be540ac61b4a7013
SHA512 eece34b42aa17dc8933c8572fedd71d9c1e84d2daadadc9b498a809634e8255ddd6bdce96a56bc4aa174b6691247412a68aaec645466646ee28ccbfd60d30a5f
SSDEEP 3072:8T9QGRzN9V5zNUsJ8iWWsSuWZXiC01/i6vnN1vOkh9Qwyp+:8pQGRzN9VdNU48RWsRWZ4i6vjAwyp+
MD5 SHA1 SHA512 SSDEEP

Password

infected

6fb0201dac82a2b6f3c409d74005eb50aab93abd7508f513636be051db86eefd.exe

IMPHASH 4f55e2a30ec0c2d3680e7e87f2ea376a
SHA256 6fb0201dac82a2b6f3c409d74005eb50aab93abd7508f513636be051db86eefd
MD5 f5fd4237e550503a8eab51ae35f147b6
SHA1 869d44d58fb734b3692500dae1f42f0d6e3b3434
SHA512 32327ca44e09d46ba8e656124f7480979b3eeb3769a94259d536a5223b2c532bd21654d8b4551d26265903f5c2be87a8da73d4571eee6fd9bfc887ea9e88350f
SSDEEP 1536:Js5KSNeteSXSI4nZ7OyP8p7+C1xIhQ6M3dfUMJn325pDedDT50ZXXKVXRKX:e5ScSHCO1p7hiO4AI1edHK56lR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

5068

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize GetConsoleAliasExesLengthA WriteConsoleOutputCharacterA HeapAlloc ScrollConsoleScreenBufferW CreateHardLinkA GlobalAlloc WideCharToMultiByte LoadLibraryW GetLocaleInfoW GetFileAttributesA HeapValidate GetModuleFileNameW FindNextVolumeMountPointW CreateJobObjectA InterlockedExchange SetThreadLocale GetStdHandle GetLastError GetProcessHeaps GetConsoleDisplayMode DisableThreadLibraryCalls BuildCommDCBW GetNumaHighestNodeNumber GetAtomNameA LoadLibraryA UnhandledExceptionFilter DnsHostnameToComputerNameA FindAtomA CreatePipe VirtualProtect GetCurrentDirectoryA ReleaseMutex FileTimeToLocalFileTime EncodePointer DecodePointer HeapReAlloc GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize GetProcAddress GetModuleHandleW ExitProcess HeapCreate HeapFree WriteFile FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage IsProcessorFeaturePresent LCMapStringW MultiByteToWideChar GetStringTypeW RaiseException

Sharing