7b940f71bff30ee23e86bb4309aa05d7fb91ffef63097566f83bb96406b345be

General

Target
7b940f71bff30ee23e86bb4309aa05d7fb91ffef63097566f83bb96406b345be
Size 193KB
Sample240417-rmbgjsda2x
SHA256 7b940f71bff30ee23e86bb4309aa05d7fb91ffef63097566f83bb96406b345be
MD5 8a87cc646ebb996f9986aee953d74538
SHA1 8f6ff62130587c1045e9e32841fe5acc7273fda8
SHA512 cc4936d079ee5efe20cad52bd079ae8674c620b8f4a38ab34cde681b79efaf3545c25cbcf0575e0b07fb961db6b4d5648f1a7d6e6766132b8a6614b9b06d75d1
SSDEEP 3072:FIkXOFvSDdBjfAGoyyO1z2v7poBAD/psUkBrbvpBMRcRfCryY6Oed7:FdZxoxEap8AzpsPjBMRcR8y35
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b1e5bd12279ecaf63aa22e082d6e833d8137d35ee32f87d2798e30e51a91367c.exe

File Explorer

7b940f71bff30ee23e86bb4309aa05d7fb91ffef63097566f83bb96406b345be

.zip 193KB
b1e5bd12279ecaf63aa22e082d6e833d8137d35ee32f87d2798e30e51a91367c.exe

.exe 292KB

7b940f71bff30ee23e86bb4309aa05d7fb91ffef63097566f83bb96406b345be

SHA256 7b940f71bff30ee23e86bb4309aa05d7fb91ffef63097566f83bb96406b345be
MD5 8a87cc646ebb996f9986aee953d74538
SHA1 8f6ff62130587c1045e9e32841fe5acc7273fda8
SHA512 cc4936d079ee5efe20cad52bd079ae8674c620b8f4a38ab34cde681b79efaf3545c25cbcf0575e0b07fb961db6b4d5648f1a7d6e6766132b8a6614b9b06d75d1
SSDEEP 3072:FIkXOFvSDdBjfAGoyyO1z2v7poBAD/psUkBrbvpBMRcRfCryY6Oed7:FdZxoxEap8AzpsPjBMRcR8y35
MD5 SHA1 SHA512 SSDEEP

Password

infected

b1e5bd12279ecaf63aa22e082d6e833d8137d35ee32f87d2798e30e51a91367c.exe

IMPHASH 49d84a51f28bda92ea8885bbc40b0c72
SHA256 b1e5bd12279ecaf63aa22e082d6e833d8137d35ee32f87d2798e30e51a91367c
MD5 7fa128c7060719f0954ca71639920e13
SHA1 f870bb7a42e1fc99dda40f11f1405846cd1dbc9d
SHA512 413a3bf1c5e57de4f0b889f8f83591a6e7f418575212d6371dd7cdf419e632c1841900a5c2e38b0f44b46080f9e48b1e2ba485e79e2c882c1d31c49f5676a16a
SSDEEP 3072:GtI08aJVW2uHCVd1sj4ZU2tezdvEoVaEvamVhvVNBDkEnq4laIrXB12g5erT7V+c:m8QuiVTDteZvkESmjxB7lJBADrT7V+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wujetadugayu\wuyugu-casevigurubuh.pdb

kernel32

GetCurrentProcess GetComputerNameW CreateDirectoryExA GetFileAttributesExA GetTickCount FindNextVolumeMountPointA GetConsoleTitleA ReadConsoleW GetConsoleAliasExesW GlobalAlloc GetVolumeInformationA GlobalFindAtomA GetLocaleInfoW GetConsoleAliasExesLengthW GetTimeFormatW GetConsoleAliasW FlushFileBuffers GetLastError SetLastError ReadConsoleA VirtualAlloc SetStdHandle GetTempFileNameA LoadLibraryA WriteConsoleA SetConsoleCtrlHandler GetNumberFormatW RemoveDirectoryW GetModuleHandleA GetVersionExA ReadConsoleInputW AddConsoleAliasA CreateThread CloseHandle SetComputerNameExA InterlockedIncrement GetProcAddress CreateFileA HeapAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA HeapFree RaiseException DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree HeapReAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA WideCharToMultiByte GetConsoleCP GetConsoleMode TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind GetConsoleOutputCP WriteConsoleW MultiByteToWideChar HeapSize LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

GetAltTabInfoA SetMenu LoadKeyboardLayoutA CharUpperBuffA

gdi32

StretchDIBits

advapi32

RegSetValueA

Sharing

General

Malware Config

Signatures

File Explorer

7b940f71bff30ee23e86bb4309aa05d7fb91ffef63097566f83bb96406b345be

b1e5bd12279ecaf63aa22e082d6e833d8137d35ee32f87d2798e30e51a91367c.exe

kernel32

user32

gdi32

advapi32

generic