37cfcc893b603492d5a747796db299b0488148fe5dbebebddbf068ad8ed0342c.zip
- SHA256 bdad23a95e4a0580751d390a01d57a225a76a73c2274a1956f79f4c09ddbaf87
Behavioral task
behavioral1
Sample
37cfcc893b603492d5a747796db299b0488148fe5dbebebddbf068ad8ed0342c.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
37cfcc893b603492d5a747796db299b0488148fe5dbebebddbf068ad8ed0342c.dll
Resource
win10v2004-20240709-en
cobaltstrike
305419896
http://82.156.133.228:39991/ca
512
82.156.133.228,/ca
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
GET
POST
255
60000
39991
%windir%\syswow64\rundll32.exe
%windir%\sysnative\rundll32.exe
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCTUlJ7J79z/MkkV8+MsYlOvREE2hhdGNzrKPFZ10lY0K5legA+um5JxESEaC0woDgSmOGrkh1giz/aQwd6tG4mihFgpi0oIbfwu6XZbE6ghYGyu2F7+A5TifRUzvU0YLXjK78EW12XhjHx4KopMF/AtOAueGwfiI2DmXwNzrBDvwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
4096
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
/submit.php
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
305419896
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/37cfcc893b603492d5a747796db299b0488148fe5dbebebddbf068ad8ed0342c |
Unsigned PE
Checks for missing Authenticode signature.
count=152, id=210, version=61030,
count=1, id=199, version=41118,
count=41, id=207, version=50929,
count=136, id=206, version=50929,
count=10, id=205, version=50929,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=220, id=1, productName=Unmarked objects,
count=53, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,