5d9afa34d58d686ea27ab01f4f681d56.zip
- SHA256 584cfa980d017c79576ec0bdf57dcb346b64d0e10dc878d5c6e6002f1582f21a
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b173b03e0988654a331c46e31e2438115d34fc57a7550a66aee784d1e74300d3.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
General
- Target 5d9afa34d58d686ea27ab01f4f681d56.zip
- Size 323KB
- Sample240831-btl9maxfle
- SHA256 584cfa980d017c79576ec0bdf57dcb346b64d0e10dc878d5c6e6002f1582f21a
- MD5 1d8bbbea9302352db70d48fba63fb8d2
- SHA1 1a7a396643e061ab794535085b3f2a476c91be23
- SHA512 d400bff34e7965088fe656dbadfc6f3b9424d062f9a1f411dc2a0e4466cb936f39b0a8a72491db4e296955e46fff08b7d06c9e6541ea993fdc2f7ec5b94c7b38
- SSDEEP 6144:J6H+mecFDA3PVeuUZ5upFuuQoSbgeSIiyK7ioAeIv8n+iJGXxh3RglT:+OeYUZ5upYuQ/0eSDRIU+ishhhC
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b173b03e0988654a331c46e31e2438115d34fc57a7550a66aee784d1e74300d3
File Explorer
-
5d9afa34d58d686ea27ab01f4f681d56.zip.zip 323KB
-
b173b03e0988654a331c46e31e2438115d34fc57a7550a66aee784d1e74300d3.exe 476KB
b173b03e0988654a331c46e31e2438115d34fc57a7550a66aee784d1e74300d3
- IMPHASH 085b8a5d9e723b8ba9982a936ce1c779
- SHA256 b173b03e0988654a331c46e31e2438115d34fc57a7550a66aee784d1e74300d3
- MD5 5d9afa34d58d686ea27ab01f4f681d56
- SHA1 4301075acafdd765528e91950c6a89b96889d97c
- SHA512 7912d1190a6d440d906c7cd908ff03d95187b894f469fc1cda0dcf985e61b74e376cd41e39fdac582e438f1c10e4be63c53e1943986943081b97cc99c72a2934
- SSDEEP 12288:yYmIjE7eNdKcWEb92Ubr4TgyUbZm6qCs8e/G:O7eNAYb92Ub8T5geL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
5
Entry point
13116
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Perforce\FRMain\code\build\win\results\Release\info\arh.pdb
kernel32
WideCharToMultiByte
CreateFileA
HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
LocalFree
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WriteFile
SetFilePointer
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStartupInfoA
Sleep
GetModuleHandleW
GetProcAddress
ExitProcess
LoadLibraryW
RaiseException
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
VirtualAlloc
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryA
RtlUnwind
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
msi
ord141
ord90
ord205
ord173
ord16
shlwapi
PathAppendW
PathRemoveFileSpecW
StrDupW
StrChrA
PathAppendA
advapi32
CryptAcquireContextW
CryptDestroyHash
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CryptReleaseContext
CryptCreateHash
CryptHashData
CryptGetHashParam
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
404KB
Virtual Size
996KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=150, version=20413,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=115, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=123, productName=VS2005 build 50727, version=50727,
count=119, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,