MrsMajor2[.]0[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
MrsMajor2.0.rar
Size 19.7MB
Sample240708-kh4h7stbjf
SHA256 3a8638a764c9b0828df230fac613d0b7402c21189f6a1148adca402472b31141
MD5 6be0eea7209fa6e64ab9c4415172fb7e
SHA1 99739ed8788430f1df7a9ebf80ab29d0f33886f9
SHA512 6bc187397ad4bf14ed3681963584824a779f4d4fb5f5d5a52788080fb78cf211c0cf6bff8ea27ad8a5cca53fdff9659f288b3e4a2c8ef5a479e879034fbbd0cf
SSDEEP 393216:pObYcuKh1Qg75KUy2ZVQbUHmoYPDWFesJ0CMPIjpmUv4GTMeG6jHvSCeEWHtGvnT:kuKhCg7sjIC0PKWFesax8uGQeHjHvSzW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MrsMajor2.0.exe

File Explorer

MrsMajor2.0.rar

.rar 19.7MB
MrsMajor2.0.exe

.exe 25.6MB

MrsMajor2.0.rar

SHA256 3a8638a764c9b0828df230fac613d0b7402c21189f6a1148adca402472b31141
MD5 6be0eea7209fa6e64ab9c4415172fb7e
SHA1 99739ed8788430f1df7a9ebf80ab29d0f33886f9
SHA512 6bc187397ad4bf14ed3681963584824a779f4d4fb5f5d5a52788080fb78cf211c0cf6bff8ea27ad8a5cca53fdff9659f288b3e4a2c8ef5a479e879034fbbd0cf
SSDEEP 393216:pObYcuKh1Qg75KUy2ZVQbUHmoYPDWFesJ0CMPIjpmUv4GTMeG6jHvSCeEWHtGvnT:kuKhCg7sjIC0PKWFesax8uGQeHjHvSzW
MD5 SHA1 SHA512 SSDEEP

MrsMajor2.0.exe

IMPHASH d7ee0bec939bda9b20c9cb9dcb985e30
SHA256 5dd4ea169cabf9226f54bb53e63ea6a1b5880a0d1222242aee378efb6255b57d
MD5 247a35851fdee53a1696715d67bd0905
SHA1 d2e86020e1d48e527e81e550f06c651328bd58a4
SHA512 a173801aaef4fab608d99b52223b5b2400d69b91edcbf33c21fcb47bd832eef9d771dfd36da350a502a371ed1739c869a7c2b4dca456c93f2feed9ac9c647c7c
SSDEEP 786432:7VQ4fX8siQIZwastE9oGH5UcnaAVBmn163+L2:7ywXwdwRQo2O1L2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset strncmp memmove strncpy strstr _strnicmp _stricmp strlen strcmp sprintf fabs ceil malloc floor free fclose memcpy strcpy tolower

kernel32

GetModuleHandleA HeapCreate RemoveDirectoryA GetTempFileNameA GetShortPathNameA GetWindowsDirectoryA GetSystemDirectoryA HeapDestroy ExitProcess GetExitCodeProcess GetNativeSystemInfo FindResourceA LoadResource SizeofResource HeapAlloc HeapFree Sleep LoadLibraryA GetProcAddress FreeLibrary GetCurrentThreadId GetCurrentProcessId CloseHandle InitializeCriticalSection GetCommandLineA GetModuleFileNameA GetEnvironmentVariableA SetEnvironmentVariableA GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter EnterCriticalSection LeaveCriticalSection GetVersionExA HeapReAlloc SetLastError TlsAlloc GetCurrentDirectoryA SetCurrentDirectoryA SetFileAttributesA DeleteFileA GetTempPathA CreateDirectoryA WriteFile CreateFileA SetFilePointer ReadFile DeleteCriticalSection

user32

CharLowerA MessageBoxA SendMessageA PostMessageA GetWindowThreadProcessId IsWindowVisible GetWindowLongA GetForegroundWindow IsWindowEnabled EnableWindow EnumWindows SetWindowPos DestroyWindow GetDC GetWindowTextLengthA GetWindowTextA SetRect DrawTextA GetSystemMetrics ReleaseDC GetSysColor GetSysColorBrush CreateWindowExA CallWindowProcA SetWindowLongA SetFocus RedrawWindow RemovePropA DefWindowProcA SetPropA GetParent GetPropA GetWindow SetActiveWindow UnregisterClassA DestroyAcceleratorTable LoadIconA LoadCursorA RegisterClassA AdjustWindowRectEx ShowWindow CreateAcceleratorTableA PeekMessageA MsgWaitForMultipleObjects GetMessageA GetActiveWindow TranslateAcceleratorA TranslateMessage DispatchMessageA GetFocus GetClientRect FillRect EnumChildWindows DefFrameProcA GetWindowRect IsChild GetClassNameA GetKeyState DestroyIcon RegisterWindowMessageA

gdi32

GetStockObject SelectObject SetBkColor SetTextColor GetTextExtentPoint32A CreateSolidBrush DeleteObject GetObjectA CreateCompatibleDC GetDIBits DeleteDC GetObjectType CreateDIBSection BitBlt CreateBitmap SetPixel

comctl32

InitCommonControlsEx

ole32

CoInitialize CoTaskMemFree RevokeDragDrop

shell32

ShellExecuteExA

winmm

timeBeginPeriod

shlwapi

PathQuoteSpacesA PathRenameExtensionA PathAddBackslashA PathUnquoteSpacesA