3d3c1a44e0ba95c13717557f65bda9aeb3078e875243fd9a94bedc416de2b2fd
- SHA256 3d3c1a44e0ba95c13717557f65bda9aeb3078e875243fd9a94bedc416de2b2fd
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 3d3c1a44e0ba95c13717557f65bda9aeb3078e875243fd9a94bedc416de2b2fd
- Size 770KB
- Sample240726-k9nl3ayepp
- SHA256 3d3c1a44e0ba95c13717557f65bda9aeb3078e875243fd9a94bedc416de2b2fd
- MD5 0416386f22054cd697c2b7802cdb9fbf
- SHA1 5a3a0e08b1dad7bb234cedf1e335ebfd63bd0632
- SHA512 145a09019a4954990638d0d6753b1f41a33c665f8805e321ae716a06d0522eeb43c4637eeece025e8dca09cd27d24aa61cc2a6554f42a03260453fc204476a85
- SSDEEP 12288:+LyyNrbuZ5qjz6089c0tXTzS3N0mHNubwR/LOBHa2pfNgPFLf+HjR4E4hHsE:KyyNravqQ99C3amtuwYHa2JOF84hHX
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
File Explorer
-
3d3c1a44e0ba95c13717557f65bda9aeb3078e875243fd9a94bedc416de2b2fd.zip 770KB
-
114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe.exe 1.2MB
114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323.exe
- IMPHASH fcc1e1d34891ecf13d7f9f0c91e336ef
- SHA256 114b868f319162c5d6ff92796e41910f54de0e89f895a066fd4980c6dba2e323
- MD5 ef95411945330db1907508d38bc373ac
- SHA1 7bb8d57cb26f3927bd741db598254efd72f249c4
- SHA512 2ca5709cae5f19b9e95b80df91d00cdc81522f41c5be7070434df8edb25f80f4c1d1704f8db7824f6cae0bb81e4cd1c987d58749a56853a1a5da65542ab2bc8c
- SSDEEP 24576:snz6dSHy7DXstIVWn4etKUBYWPezgW8Ns:8zf5N4qKUGWP9W8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
730344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetStdHandle
SetStdHandle
CreateFileA
FindFirstFileExW
FindNextChangeNotification
FlushFileBuffers
GetFileAttributesExW
GetFileInformationByHandle
GetFileSize
GetFileType
GetFileTime
LockFile
LockFileEx
SetEndOfFile
SetFilePointer
SetFilePointerEx
SetFileValidData
UnlockFile
UnlockFileEx
AreFileApisANSI
EncodePointer
DecodePointer
EncodeSystemPointer
DecodeSystemPointer
SetHandleInformation
SetLastError
DisconnectNamedPipe
PeekNamedPipe
GetNamedPipeInfo
GetNamedPipeHandleStateW
HeapCreate
CreateIoCompletionPort
PostQueuedCompletionStatus
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateEventA
CancelWaitableTimer
WaitForMultipleObjects
GetProcessTimes
GetCurrentProcessId
GetCurrentThreadId
GetThreadPriorityBoost
GetThreadPriority
GetProcessVersion
SetPriorityClass
GetPriorityClass
GetProcessId
GetThreadContext
FlushInstructionCache
GetThreadTimes
OpenProcess
GetProcessHandleCount
GetProcessPriorityBoost
SetProcessPriorityBoost
GetThreadIOPendingFlag
GetVersion
GetVersionExA
GetNativeSystemInfo
SetSystemTimeAdjustment
CreateFileMappingW
FlushViewOfFile
SetProcessWorkingSetSize
GetWriteWatch
ResetWriteWatch
CreateMemoryResourceNotification
IsProcessInJob
AssignProcessToJobObject
SetInformationJobObject
DisableThreadLibraryCalls
FreeResource
GetModuleFileNameA
GetModuleFileNameW
LockResource
GlobalUnlock
GlobalCompact
GlobalUnfix
GlobalUnWire
LocalUnlock
LocalShrink
LocalCompact
GetProcessAffinityMask
GetProcessIoCounters
ConvertFiberToThread
CreateFiberEx
CreateFiber
ConvertThreadToFiber
PulseEvent
GlobalDeleteAtom
InitAtomTable
DeleteAtom
SetHandleCount
SetMessageWaitingIndicator
ClearCommBreak
ClearCommError
EscapeCommFunction
GetCommMask
GetCommModemStatus
GetCommTimeouts
TransmitCommChar
PrepareTape
EraseTape
CreateTapePartition
GetTapeStatus
MulDiv
GetMailslotInfo
SetMailslotInfo
AddAtomA
GetNamedPipeHandleStateA
VerifyVersionInfoA
MapUserPhysicalPagesScatter
WriteConsoleW
CloseHandle
CreateFileW
GetConsoleMode
GetConsoleOutputCP
HeapReAlloc
HeapSize
GetProcessHeap
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindClose
HeapFree
HeapAlloc
GetModuleHandleExW
TerminateProcess
ExitProcess
GetCurrentProcess
WriteFile
RtlPcToFileHeader
RaiseException
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLastError
RtlUnwindEx
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
user32
GetLayeredWindowAttributes
GetDlgCtrlID
GetAsyncKeyState
TrackPopupMenuEx
MenuItemFromPoint
BeginPaint
GetClassWord
GetCursorInfo
CallWindowProcA
winspool.drv
ScheduleJob
FindClosePrinterChangeNotification
ReadPrinter
AbortPrinter
FindFirstPrinterChangeNotification
shell32
ord716
DragQueryFileA
DragQueryPoint
DragFinish
FindExecutableA
ShellAboutA
ExtractIconExA
SHFileOperationA
SHEmptyRecycleBinA
Shell_NotifyIconA
SHGetDiskFreeSpaceExA
SHSetLocalizedName
ord727
ord153
ord152
ord24
ord16
ord17
ord21
ord189
SHBrowseForFolderA
SHChangeNotify
ord191
ord4
ord645
ord47
ord3
SHGetSettings
SHBindToParent
ShellExecuteExA
ole32
CoCancelCall
CoTestCancel
CoEnableCallCancellation
CoDisableCallCancellation
IIDFromString
StringFromGUID2
CoGetTreatAsClass
CoGetCancelObject
CoSwitchCallContext
CoRevertToSelf
CoCopyProxy
CoFileTimeNow
OleDoAutoConvert
OleRegGetMiscStatus
OleGetIconOfClass
IsAccelerator
MkParseDisplayName
CoGetObject
CoIsOle1Class
CoAllowSetForegroundWindow
CoGetInstanceFromFile
CoRevokeInitializeSpy
CLSIDFromProgIDEx
CoImpersonateClient
CoQueryClientBlanket
CoGetCallerTID
CoGetCurrentLogicalThreadId
CoGetContextToken
CoGetObjectContext
CoRevokeClassObject
CoGetMarshalSizeMax
CoUnmarshalInterface
CoGetStandardMarshal
CoGetStdMarshalEx
CoIsHandlerConnected
CoMarshalInterThreadInterfaceInStream
CoQueryProxyBlanket
CoSetProxyBlanket
CoSetCancelObject
CoTaskMemRealloc
gdiplus
GdiplusStartup
userenv
GetUserProfileDirectoryA
Name
.text
Size
763KB
Virtual Size
763KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
274KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
204KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=40, id=261, version=33218,
count=16, id=260, version=33218,
count=9, id=259, version=33218,
count=15, id=257, version=30795,
count=281, id=1, productName=Unmarked objects,
count=1, id=259, version=33133,
count=1, id=260, version=33808,
count=1, id=261, version=33808,
count=1, id=255, version=33808,
count=1, id=258, version=33808,