2f0b4b4819d48ff7ba4dbeb258a93189.zip
- SHA256 e910c690fdd6944df35d0de3cbc5241ac2172dcf02d43b2ccc9f72470e7b37f0
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a115fc118d5b0933c8550da6125b78d4956e27f671c00945d0ad04d5839dab4.exe
Resource
win7-20240704-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a115fc118d5b0933c8550da6125b78d4956e27f671c00945d0ad04d5839dab4.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2f0b4b4819d48ff7ba4dbeb258a93189.zip
- Size 194KB
- Sample240830-3baxessemp
- SHA256 e910c690fdd6944df35d0de3cbc5241ac2172dcf02d43b2ccc9f72470e7b37f0
- MD5 6c942be91793683230c1c87f054d6cec
- SHA1 fb01814b93471bc5b81b7aa3c46ef3559456afe3
- SHA512 32a51b702b9c866b7cf6b23705f0b8f0dba5c59f87474756364eeebe1e3c74e4e73d6deab6021b9b29e0e7688b9a96b13e17849052030e7af972d418a5c0eb51
- SSDEEP 6144:11LiKQOj2852S7KrkatIaUVBY9/QJHQP/qvi373T:f7N52SUk6IBu2AS0/
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3a115fc118d5b0933c8550da6125b78d4956e27f671c00945d0ad04d5839dab4
File Explorer
-
2f0b4b4819d48ff7ba4dbeb258a93189.zip.zip 194KB
-
3a115fc118d5b0933c8550da6125b78d4956e27f671c00945d0ad04d5839dab4.exe 10.9MB
3a115fc118d5b0933c8550da6125b78d4956e27f671c00945d0ad04d5839dab4
- IMPHASH af44dcafed165daab29f132f710193c2
- SHA256 3a115fc118d5b0933c8550da6125b78d4956e27f671c00945d0ad04d5839dab4
- MD5 2f0b4b4819d48ff7ba4dbeb258a93189
- SHA1 98067909fa21b0bf107449206405ac8b13e5c776
- SHA512 090e957459548ed42424f07cb387664bff76d0efcc5b36943339b909290696496738c0b4586f446df4f6c0f1aa4faccb6ad66aab404a8775e7146491b4cd16e1
- SSDEEP 6144:HLmhaXrxJHCx7HdqAT7mvs/bNAk3B79NmVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV1:HLmhaXrxJHuHdPT1n9N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
6208
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\sugun\xuyukinubo\newevegovog\jozanuh9\yuxugucoseru\g.pdb
kernel32
SearchPathW
SetInformationJobObject
lstrlenA
InterlockedDecrement
InitializeSListHead
GetSystemWindowsDirectoryW
GetProfileStringW
FlushViewOfFile
GetUserDefaultLangID
LoadLibraryW
ReadConsoleInputA
FreeConsole
GetSystemWow64DirectoryW
HeapDestroy
SetConsoleCursorPosition
GetModuleFileNameW
GetOverlappedResult
GetStartupInfoW
CreateDirectoryA
GetCPInfoExW
GetLastError
GetProcAddress
VirtualAlloc
CreateNamedPipeA
SetStdHandle
GetPrivateProfileStringA
OpenMutexA
LocalAlloc
MoveFileA
PostQueuedCompletionStatus
FindAtomA
GetPrivateProfileStructA
SetEnvironmentVariableA
WTSGetActiveConsoleSessionId
HeapSetInformation
FreeEnvironmentStringsW
GetCurrentDirectoryA
OutputDebugStringA
FindAtomW
CloseHandle
SetFilePointer
GetCommandLineA
InterlockedIncrement
DecodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
RtlUnwind
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
GetModuleHandleW
SetLastError
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
ExitProcess
GetModuleFileNameA
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
IsBadReadPtr
HeapCreate
WriteFile
GetStringTypeW
MultiByteToWideChar
WriteConsoleW
OutputDebugStringW
LCMapStringW
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
IsProcessorFeaturePresent
RaiseException
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
CreateFileW
winhttp
WinHttpReadData
Name
.text
Size
138KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
69KB
Virtual Size
4.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10.6MB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=171, productName=VS2010 build 30319, version=30319,
count=26, id=158, productName=VS2010 build 30319, version=30319,
count=125, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=109, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,