a129e6a919043d62a49c615b80be5f88.bin
- SHA256 127ae2b14e167b8f18810f6cfaf90ba5c144e3559fffc036e0d3526e725ab841
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f4146aecc21e1413da1fec7e17e20a6fb90adc191c82239b24f178251baddb14.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
- Target a129e6a919043d62a49c615b80be5f88.bin
- Size 233KB
- Sample240601-db7tqafd2t
- SHA256 127ae2b14e167b8f18810f6cfaf90ba5c144e3559fffc036e0d3526e725ab841
- MD5 719a46a05c6c07c14c44968371a48226
- SHA1 2418e096c79f8ea2be907716757ca6a4901eae02
- SHA512 839ecf022ca344d9cb8d3acf0445b0980a96b30ce50844114b3fc54d9353fc711e10e380cb1f55e0e1b9068072a2289206a3201dbe767bc0fae954ce5f0db54c
- SSDEEP 6144:xhNzmQolzUn0mmE8vU/a97CEd5KBWxSlyuV3RyGG:drezFsEdcBWxSl5V3QX
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/f4146aecc21e1413da1fec7e17e20a6fb90adc191c82239b24f178251baddb14.exe
File Explorer
-
a129e6a919043d62a49c615b80be5f88.bin.zip 233KB
-
f4146aecc21e1413da1fec7e17e20a6fb90adc191c82239b24f178251baddb14.exe.exe 343KB
f4146aecc21e1413da1fec7e17e20a6fb90adc191c82239b24f178251baddb14.exe
- IMPHASH f60d9bb04c40f0b0957242fb52e0df53
- SHA256 f4146aecc21e1413da1fec7e17e20a6fb90adc191c82239b24f178251baddb14
- MD5 a129e6a919043d62a49c615b80be5f88
- SHA1 c86a17efd90c3a7f792aa3934ed1e613d69fe901
- SHA512 675fd5cba9b36e30839542e5d2b3d9aff0ef3c1392fd3aa684c96472d954994024f89b686fab844fabcd28c70463aded4ceeaa7377c831e28be447b2adaa0340
- SSDEEP 6144:qdEgfcrheedn4pM3Rfs2gAtP7+TN3SPvTtaXndT:qdfcr0eFQv2gAtK8Pvun
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
15888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LocalAlloc
GetLastError
SetLastError
ReadProcessMemory
_lopen
OpenEventA
LoadLibraryW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleA
GetSystemDirectoryW
CreateDirectoryW
SetFileAttributesW
GetVolumeInformationW
IsBadStringPtrW
BuildCommDCBA
SetComputerNameA
SetInformationJobObject
FindNextVolumeA
FindNextVolumeMountPointW
GetOEMCP
GetCalendarInfoA
GetNumberFormatA
GetStringTypeA
SetConsoleCursorInfo
SetConsoleWindowInfo
AddConsoleAliasW
ReadFile
SetEndOfFile
WriteConsoleW
SetFilePointerEx
EncodePointer
DecodePointer
HeapFree
RaiseException
RtlUnwind
GetCommandLineA
IsProcessorFeaturePresent
HeapAlloc
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapSize
GetProcessHeap
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LCMapStringW
IsValidCodePage
GetACP
GetCPInfo
HeapReAlloc
OutputDebugStringW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CreateFileW
CloseHandle
SetStdHandle
ReadConsoleW
user32
GetSysColorBrush
GetMenu
DdeKeepStringHandle
Name
.text
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
152KB
Virtual Size
36.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
98KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=30, id=223, productName=VS2013 build 21005, version=21005,
count=129, id=224, productName=VS2013 build 21005, version=21005,
count=43, id=225, productName=VS2013 build 21005, version=21005,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=1, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,