blumfarm_W9CQClad9a[.]zip_pw_infected[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
blumfarm_W9CQClad9a.zip_pw_infected.zip
Size 6.2MB
Sample240604-js6wmsaf38
SHA256 eb91f920813289d597bce9216b2a2af7d327b53b0e21d3a2b5705be1149384ac
MD5 5664902531461aed15a6e0b558bb86cf
SHA1 571b28d0370b0c008c43182a2c278abc2a2febf4
SHA512 dea0eb034ab1ec90534ac2d1d4713999200e196fe24c7d8e565bce628157220561330d3c67b0f40769e34676de0004fb1d9c687200cac5934cd8ba61c4028c8d
SSDEEP 196608:ZUbwislc+bnWzBG/5uFmK98Nt+iR/yIPn4k2areVVR:ZUUisl1bEBi73f/yI+7/R
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/blumfarm_W9CQClad9a.exe

File Explorer

blumfarm_W9CQClad9a.zip_pw_infected.zip

.zip 6.2MB
0x0008000000023464-119

.zip 6.2MB
PASSWORD 123.txt

32B
blumfarm_W9CQClad9a.exe

.exe 6.3MB

blumfarm_W9CQClad9a.zip_pw_infected.zip

SHA256 eb91f920813289d597bce9216b2a2af7d327b53b0e21d3a2b5705be1149384ac
MD5 5664902531461aed15a6e0b558bb86cf
SHA1 571b28d0370b0c008c43182a2c278abc2a2febf4
SHA512 dea0eb034ab1ec90534ac2d1d4713999200e196fe24c7d8e565bce628157220561330d3c67b0f40769e34676de0004fb1d9c687200cac5934cd8ba61c4028c8d
SSDEEP 196608:ZUbwislc+bnWzBG/5uFmK98Nt+iR/yIPn4k2areVVR:ZUUisl1bEBi73f/yI+7/R
MD5 SHA1 SHA512 SSDEEP

Password

infected

blumfarm_W9CQClad9a.exe

SHA256 d8946020d5d75b42ea3ee28fcb29ab44ca2e47b51d9256f92914bcb4ebc0de23
MD5 2f96d2c284fc2e7998663eec9a1cc401
SHA1 f21730784d3086e24cc2e657a7d88dfc4c5d6d45
SHA512 665ca27fa8a5779240b0ec5f965e5bed03ce1b4e6911ae590b0f78b5d7b58b745a5d72530b54cc7fe1f9ff022f0218a5d22ff1469fcb57ad4fd39add5535f427
SSDEEP 98304:JAaDFuqJFhPlTCDTeIHM2y4nmN5YU+YC8aFZIA26yo9eIfVv+aNfr4AI/hsfU:WDqJvPcit2y4nmoIA7yoYeFr4AIefU
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

42488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

blumfarm_W9CQClad9a.zip_pw_infected.zip

0x0008000000023464-119

PASSWORD 123.txt

blumfarm_W9CQClad9a.exe

generic