f7f6eb480fe715733e509d0489171c18.bin
- SHA256 06b0a54387089837ec942b7b26d9b6e6644e793ec8ee1600674951b3e9e8ce64
Password
infected
Behavioral task
behavioral1
Sample
3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4.exe
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target f7f6eb480fe715733e509d0489171c18.bin
- Size 1.0MB
- Sample240708-evd67atgph
- SHA256 06b0a54387089837ec942b7b26d9b6e6644e793ec8ee1600674951b3e9e8ce64
- MD5 3634cbfa2e5f12b1d2af625a16175c5a
- SHA1 ef03ba76f33e3aa7cd7654b81e90fba0ac113630
- SHA512 ab1be6981062627ed37138a19a27c66e38155e3d8c3ce1c63827562463af5cc55612881e0093f628d2e1f8dfa44e6124dc9df5a928db8f8712fdbbd67fc43f1f
- SSDEEP 24576:WCIA+DRvBy73xUjLbH+pjtbWZ0ClWR9zg8UHNZ0hwQ7TM5KMgKg:W9nbywH4jIZyR9z0tZxQ7TM5KMgKg
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4.exe unpack002/out.upx
File Explorer
-
f7f6eb480fe715733e509d0489171c18.bin.zip 1.0MB
-
3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4.exe.exe 1.0MB
-
out.upx.exe 2.3MB
3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4.exe
- SHA256 3898534fa62f5a8f169c66900f183e5637e7c4f9be8c46591568ff489bc432d4
- MD5 f7f6eb480fe715733e509d0489171c18
- SHA1 e28a03d8c62eae2687d8d8f6b6ccb73377bc1a48
- SHA512 962a440c8b5e148821e5db065bddcf861899667319ff1d3ad497e7629c6212235e51d1902d4685af6248f83f7c4a8a1c2dc9805f58c5a27a87a40067e5792988
- SSDEEP 24576:BW9a/w9mj+Nhf+x+eswsX08cjwPBXMX7pCeg8nr5G79Bgx+:BWYWNQUe3sX0OPuXV1vnAwx+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
2997344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=46, id=261, version=32533,
count=12, id=260, version=32533,
count=9, id=259, version=32533,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=207, id=1, productName=Unmarked objects,
count=10, id=259, version=32824,
count=1, id=260, version=32824,
count=1, productName=Unmarked objects (old),
count=62, id=261, version=32824,
count=1, id=256, version=32825,
count=1, id=258, version=32825,
out.upx
- SHA256 a5b1ae01b28fc2cc9cb4c7e16b6134e3c63214600bb295f662b88ba0dff7b30c
- MD5 b0661037d14a6ffa7e96926ec66825c5
- SHA1 09aa672275df603d88cfb3c48493d5587dc5c382
- SHA512 bb37d201b75dc0ca01d5fe8b6eb81db403ecedc0255f44a4599d2f180f23a8e1c4f47a343533153de117439977e5e631b2b6c7d7ded45b2a2c5496b02db7081b
- SSDEEP 49152:zNRyhWAXn+KazPonIdN7+q1uU3RkHU211b0GyNb7:nk+DMIZIUaHJm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
396312
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
DotNetRuntimeDebugHeader
Name
.text
Size
407KB
Virtual Size
407KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.managed
Size
985KB
Virtual Size
984KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
hydrated
Size
Virtual Size
439KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
897KB
Virtual Size
897KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
94KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=261, version=32533,
count=12, id=260, version=32533,
count=9, id=259, version=32533,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=207, id=1, productName=Unmarked objects,
count=10, id=259, version=32824,
count=1, id=260, version=32824,
count=1, productName=Unmarked objects (old),
count=62, id=261, version=32824,
count=1, id=256, version=32825,
count=1, id=258, version=32825,