ca20476eab92bfb30bbd6b7ad2961010.bin
- SHA256 8fc194e90ee0b440b58e5c41c56a96ee564fec28e7a71b5d2d6f868fd326a381
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5913b56762d3253e0d9cefdd62f311f2a1a902f643b4c4cdb0220d1a38a3dbf9.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
- Target ca20476eab92bfb30bbd6b7ad2961010.bin
- Size 156KB
- Sample240518-dnq2qshe27
- SHA256 8fc194e90ee0b440b58e5c41c56a96ee564fec28e7a71b5d2d6f868fd326a381
- MD5 4f162a2de333ab7e2edc28937a83ba28
- SHA1 ec4bfb85f20854708df73a69010d425d10185aa4
- SHA512 de956d4d23e9e2bf1bacd0c30dd99591ce2807fb436b21ba90a4ba780d1c5d2652b1f38ca0d841eb86c6e78c1b3d407eeb5248ad1cb5b76bc70c13b2d0b6dcd1
- SSDEEP 3072:OzkWUSre/RZUEoUXcBKsLUa3qvoV1izbxW/7Ripw86iQYhm5S2E7:NSO/9mhIhQim7Rmw8s872E7
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/5913b56762d3253e0d9cefdd62f311f2a1a902f643b4c4cdb0220d1a38a3dbf9.exe
File Explorer
-
ca20476eab92bfb30bbd6b7ad2961010.bin.zip 156KB
-
5913b56762d3253e0d9cefdd62f311f2a1a902f643b4c4cdb0220d1a38a3dbf9.exe.exe 228KB
5913b56762d3253e0d9cefdd62f311f2a1a902f643b4c4cdb0220d1a38a3dbf9.exe
- IMPHASH 0a1b694cded55d63fb2b3a5a40f4522c
- SHA256 5913b56762d3253e0d9cefdd62f311f2a1a902f643b4c4cdb0220d1a38a3dbf9
- MD5 ca20476eab92bfb30bbd6b7ad2961010
- SHA1 549e27826585706b0a3fbd5ca62fe9cf94360242
- SHA512 1355f0da04dbc5fe79c122793a6ffa720dfb932d07910fb1dc2a728751fb2e4636439c03016f2a9276f838133fd98768a7b6ee086c553d78b75d57c8c7ddd350
- SSDEEP 6144:wB5Q/aqNI6aZg0RMrKB0uEdRj4pHLKd1k6cw:kDZgCMrk0u1Q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
16387
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetConsoleAliasA
GetTickCount
GetSystemDirectoryW
WriteConsoleW
SetComputerNameExW
IsBadStringPtrA
GetLastError
SetLastError
GetProcAddress
RemoveDirectoryA
LoadLibraryA
OpenMutexA
SystemTimeToTzSpecificLocalTime
LocalAlloc
GetNumberFormatW
CreateEventW
GetModuleFileNameA
LoadLibraryExA
BuildCommDCBA
VirtualProtect
PurgeComm
GetVolumeInformationW
CloseHandle
CreateFileW
GetStringTypeW
OutputDebugStringW
WriteConsoleA
GetComputerNameA
FlushFileBuffers
GetConsoleCP
IsProcessorFeaturePresent
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
RaiseException
RtlUnwind
IsDebuggerPresent
HeapAlloc
HeapSize
EnterCriticalSection
LeaveCriticalSection
ReadFile
GetConsoleMode
ReadConsoleW
HeapFree
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
SetFilePointerEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
SetStdHandle
LCMapStringW
SetEndOfFile
user32
SetCaretPos
GetMenuItemID
ChangeDisplaySettingsW
gdi32
GetCharWidthI
ole32
CoMarshalHresult
msimg32
AlphaBlend
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
91KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=223, productName=VS2013 build 21005, version=21005,
count=141, id=224, productName=VS2013 build 21005, version=21005,
count=46, id=225, productName=VS2013 build 21005, version=21005,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,