befeb13d03669a0f610ba500df017d7b1c2155d86cc7e985feb439a867851fe0

General

Target
befeb13d03669a0f610ba500df017d7b1c2155d86cc7e985feb439a867851fe0
Size 141KB
Sample240830-3smybatdnm
SHA256 befeb13d03669a0f610ba500df017d7b1c2155d86cc7e985feb439a867851fe0
MD5 d7ddc1532cb71975cab306673d44ac55
SHA1 f7c069045f9058817566f86477ab7fc733f1998b
SHA512 ba125edc6b8a8f9a0098252b788a64b328ce25aad5e5cd470604dc72926b74cac2c13e909411498250ec83b4ac4f988606e5ffab0f5b4b2b79225a971cbcdef0
SSDEEP 3072:4XyZCJ7cO4Ft68Nf9hdUAilUGVJN2jd+PQZ3jmrM3lCAAvEX:yygJ7cO2U8lzdYfYSsv3lRA8X
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ed38d0a2443e4c2ea2ccb9c381f06aa11380c1c51117ef3eb9f327e9bca88411

File Explorer

befeb13d03669a0f610ba500df017d7b1c2155d86cc7e985feb439a867851fe0

.zip 141KB
ed38d0a2443e4c2ea2ccb9c381f06aa11380c1c51117ef3eb9f327e9bca88411

.exe 14.3MB

befeb13d03669a0f610ba500df017d7b1c2155d86cc7e985feb439a867851fe0

SHA256 befeb13d03669a0f610ba500df017d7b1c2155d86cc7e985feb439a867851fe0
MD5 d7ddc1532cb71975cab306673d44ac55
SHA1 f7c069045f9058817566f86477ab7fc733f1998b
SHA512 ba125edc6b8a8f9a0098252b788a64b328ce25aad5e5cd470604dc72926b74cac2c13e909411498250ec83b4ac4f988606e5ffab0f5b4b2b79225a971cbcdef0
SSDEEP 3072:4XyZCJ7cO4Ft68Nf9hdUAilUGVJN2jd+PQZ3jmrM3lCAAvEX:yygJ7cO2U8lzdYfYSsv3lRA8X
MD5 SHA1 SHA512 SSDEEP

Password

infected

ed38d0a2443e4c2ea2ccb9c381f06aa11380c1c51117ef3eb9f327e9bca88411

IMPHASH a07a52f9260a9a13a9d974f54b55a466
SHA256 ed38d0a2443e4c2ea2ccb9c381f06aa11380c1c51117ef3eb9f327e9bca88411
MD5 2d357e20218ecce7a188d34e2163ac1c
SHA1 1a5bf816db5c146b3b685fdb28c3761608fdfef4
SHA512 59d6d72c15003acd59936ad400a1d1d465c1d109e9c7360f14603c709679e1fddabfae87252fbb0829fad05fa668deca594715d4775bb2fa9b04af776a7fb182
SSDEEP 6144:uM0Em6Qk5N3Sccccccccccccccccccccccccccccccccccccccccccccccccccc8:oEma
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

nddeapi

NDdeShareAddA NDdeShareGetInfoA NDdeShareEnumA NDdeShareSetInfoA

certcli

CACloseCertType CACloseCA CADeleteCA CAEnumFirstCA

user32

IsDialogMessageW CreateDesktopA wsprintfW LoadIconA LoadMenuW GetMessageW DrawStateW LoadCursorA DialogBoxParamA InsertMenuA PeekMessageW GetClassLongA PostMessageW

kernel32

GetModuleHandleA WaitNamedPipeA CreateDirectoryA EnterCriticalSection lstrcmp lstrcmp CreateMutexA IsBadStringPtrA FindFirstFileA SystemTimeToFileTime LoadLibraryW LoadLibraryExW GetProcAddress lstrcmp lstrcmp lstrcmp

shlwapi

PathIsRootA UrlIsA PathCommonPrefixA UrlGetPartA UrlGetLocationA UrlEscapeA UrlHashA PathCombineA UrlCombineA UrlCreateFromPathA UrlIsNoHistoryA UrlUnescapeA PathCompactPathA

clusapi

ClusterEnum CloseCluster ClusterControl CloseClusterNode CloseClusterGroup

advapi32

ReadEventLogW CryptSignHashA RegOpenKeyA RegUnLoadKeyA RegReplaceKeyA RegCreateKeyExW OpenEventLogA RegRestoreKeyW IsTextUnicode GetUserNameA RegEnumKeyW

comsvcs

CoCreateActivity CoLoadServices CoEnterServiceDomain RecycleSurrogate SafeRef

Sharing

General

Malware Config

Signatures

File Explorer

befeb13d03669a0f610ba500df017d7b1c2155d86cc7e985feb439a867851fe0

ed38d0a2443e4c2ea2ccb9c381f06aa11380c1c51117ef3eb9f327e9bca88411

nddeapi

certcli

user32

kernel32

shlwapi

clusapi

advapi32

comsvcs

generic