3[.]eml | Triage™

General

Target
3.eml
Size 1.2MB
Sample240603-pm8e6sff75
SHA256 c58dab82bcdb1d43dd83799111d62a05a94948d2dade4255d862bec1bcfb05c3
MD5 b2c87310269645b6ff168000fdbe65cb
SHA1 9d008dc5f33c1d023a0d7f6f032006a138953070
SHA512 27582b67aad9417c37f18a1545a1d392fdb6165180136e1708b190f86443ce5084e048a18d4140b9308e0f6dacac1833b6c8770cbc4d72dba4c7e9eabf4211df
SSDEEP 24576:FLO5yDDNO+ZW0pNm4gWeHOvgMNX8IEgGK6sk9YoJ+:3HNDYOR4Ora9Yx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/SKM 26399.exe

File Explorer

3.eml

.eml 1.2MB
SKM 26399.gz

.rar 896KB
SKM 26399.exe

.exe 1.1MB
email-html-1.txt

.html 9KB

3.eml

SHA256 c58dab82bcdb1d43dd83799111d62a05a94948d2dade4255d862bec1bcfb05c3
MD5 b2c87310269645b6ff168000fdbe65cb
SHA1 9d008dc5f33c1d023a0d7f6f032006a138953070
SHA512 27582b67aad9417c37f18a1545a1d392fdb6165180136e1708b190f86443ce5084e048a18d4140b9308e0f6dacac1833b6c8770cbc4d72dba4c7e9eabf4211df
SSDEEP 24576:FLO5yDDNO+ZW0pNm4gWeHOvgMNX8IEgGK6sk9YoJ+:3HNDYOR4Ora9Yx
MD5 SHA1 SHA512 SSDEEP

Extracted URLs

file http://www.mannaigroup.com

SKM 26399.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 71e0f19321cc5cb94fabeb2f8b2428874796a9bacd25580c8cd366539822de66
MD5 5b46b07fbd077936f60e13f52f37dd2c
SHA1 50877cd5258aaad159680de93285ae8db97c448d
SHA512 51280769d435cd15542eb46125e4c5added6f8d822db1ea402ff8ffca982c9ebf0b987dfcde79d5b36079412ea03d42b57b8e64e19f918948511d136744b5f03
SSDEEP 24576:rMYe82eN5is4lRugDWRf6xztqFxoI6fbe2NWHV5hGnpcV:rMYeeN5is0RugDWtewxozbHNOVjGn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1115606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

3.eml

Extracted URLs

SKM 26399.gz

SKM 26399.exe

mscoree

dotnet

email-html-1.txt

Sharing

General

Malware Config

Signatures

File Explorer

3.eml

Extracted URLs

SKM 26399.gz

SKM 26399.exe

mscoree

dotnet

email-html-1.txt