5677387e86650ea25137cb5bce341349.zip
- SHA256 b8fc55e5a5df539b19ebc778c55d2a16cc4115d7da7b8f0c0ff985aca64d902b
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 5677387e86650ea25137cb5bce341349.zip
- Size 29KB
- Sample240831-bfkhwawgmb
- SHA256 b8fc55e5a5df539b19ebc778c55d2a16cc4115d7da7b8f0c0ff985aca64d902b
- MD5 66166c44842cc2009634027d2f329b5c
- SHA1 a36470dec161f45f6fb2e6e5e0961b0f3a525fd1
- SHA512 9ae393b5f1067a0aace85dd3d89428673d6cca0eb11cba5fcb409a2d5e7728f297d004d14caa352d47b3f410808905c65915134c554c9f78a63d7008d7a14374
- SSDEEP 384:NXhjsmUAy8rzP4raMy0t9yHiQF6BZr++4C2p1dfqigV0ZWifA3NiR2/YGcqFi2ci:NXhoqP4raMAiraz1JMfifoi+i2c3eF/
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d
File Explorer
-
5677387e86650ea25137cb5bce341349.zip.zip 29KB
-
ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d.exe 52KB
ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d
- IMPHASH e0f61286c6396ccf28fed994d6a49819
- SHA256 ee5c2e89a5f9513f960c2253cd2fd2ce6a4f8c4db55d5daf0d0e5cc93b3b020d
- MD5 5677387e86650ea25137cb5bce341349
- SHA1 bf3e5583fb2b052a3ca9d9fd53e75c6bab6942d2
- SHA512 d0e079e0eef54a32a408e47131633f3b82a3d119fe261c71749f38b1f39188e3d0965da37caa5e9850a0791a8bafdefed566a2c3cbd17c26eeb8f92cdbd9de86
- SSDEEP 768:yCCCFlkbwAYbFshpyiB9L9Mx2BWseUCHGAwk5R9J:6bw/6plBTFBYNNR9J
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
22960
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetTickCount
FreeConsole
TlsAlloc
TlsAlloc
user32
CheckDlgButton
DestroyMenu
GetAncestor
SetParent
GetCursorInfo
GetPropA
SetUserObjectInformationW
GetDC
AppendMenuW
SetWindowLongW
AppendMenuA
ChangeDisplaySettingsA
UnionRect
DrawTextExA
GetUpdateRect
CreateDialogIndirectParamW
GetWindowLongW
ExcludeUpdateRgn
CallMsgFilterA
GetDlgItem
CascadeWindows
GetSubMenu
GetClassWord
GetUserObjectSecurity
GetParent
DlgDirListW
PeekMessageA
SetWindowTextW
CreateMDIWindowA
RemoveMenu
LoadKeyboardLayoutW
GetLastActivePopup
AttachThreadInput
LoadKeyboardLayoutA
EnumDisplaySettingsExW
ws2_32
accept
WSAWaitForMultipleEvents
WSACancelBlockingCall
inet_ntoa
WSAInstallServiceClassA
setsockopt
WSAEnumProtocolsW
WSAHtons
WSASendTo
WSAEnumProtocolsA
WSAEnumNameSpaceProvidersW
WSAEnumNameSpaceProvidersA
WSARecvDisconnect
getprotobyname
getprotobynumber
getservbyname
WSAGetServiceClassNameByClassIdA
gethostbyaddr
gethostbyname
WSAGetQOSByName
gethostname
WSAGetServiceClassInfoA
WSASocketW
WSAUnhookBlockingHook
getpeername
WSAHtonl
WSAEventSelect
WSAGetLastError
WSASetServiceW
rtm
RtmUpdateAndUnlockRoute
RtmRegisterForChangeNotification
RtmCreateDestEnum
RtmGetNextHopInfo
RtmLockRoute
RtmCreateRouteList
RtmReleaseChangedDests
RtmGetChangedDests
RtmGetExactMatchDestination
RtmReleaseEntities
RtmGetEntityInfo
RtmReleaseNextHopInfo
RtmReleaseRoutes
RtmGetRouteInfo
RtmIgnoreChangedDests
RtmReleaseRouteInfo
RtmGetRoutePointer
RtmCreateNextHopEnum
RtmLockDestination
RtmGetEnumRoutes
RtmGetEntityMethods
RtmFindNextHop
RtmInvokeMethod
RtmDeleteEnumHandle
RtmIsBestRoute
secur32
EnumerateSecurityPackagesW
AcquireCredentialsHandleW
FreeCredentialsHandle
EnumerateSecurityPackagesA
RevertSecurityContext
ApplyControlToken
ImpersonateSecurityContext
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
512B
Virtual Size
429B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=125, productName=VS2005 build 50727, version=50727,
count=26, id=109, productName=VS2005 build 50727, version=50727,
count=19, id=123, productName=VS2005 build 50727, version=50727,
count=113, id=1, productName=Unmarked objects,
count=6, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,