849805ea6e2b680d982b98c37c66f7bc.zip
- SHA256 0ae81beb2a9f1ae1efdea16e63ea6aa35fb1e180c291f91b37cf7cceee18fdcb
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d4edb3af05551d1da8af2312c1307cb76764124a59c5234a1cbc894c3806c43.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
General
- Target 849805ea6e2b680d982b98c37c66f7bc.zip
- Size 216KB
- Sample240831-dmb67asfll
- SHA256 0ae81beb2a9f1ae1efdea16e63ea6aa35fb1e180c291f91b37cf7cceee18fdcb
- MD5 0b0f641675b3d9f21d323690ed49a4aa
- SHA1 52f36734f417c99aaa498153ef2de6ea03169e3b
- SHA512 ed3fe4338e060a2a95d6c2397702fcc9e00f39475d3b6f75410074d963d13eebed9fd4bb6078c2b336af0e9d0727a49c5d99426af583d49acc3eaa5364ca0e77
- SSDEEP 3072:KI4YEDvDB42QNfCCZuHvSyyf0OhRxUQwmOzfVAZVOy9U0q0+9ERj1IsSsyrUV2kC:BAu5Yy0DVxztAG7wj1PSXr0UWbpxc
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/7d4edb3af05551d1da8af2312c1307cb76764124a59c5234a1cbc894c3806c43
File Explorer
-
849805ea6e2b680d982b98c37c66f7bc.zip.zip 216KB
-
7d4edb3af05551d1da8af2312c1307cb76764124a59c5234a1cbc894c3806c43.exe 367KB
7d4edb3af05551d1da8af2312c1307cb76764124a59c5234a1cbc894c3806c43
- IMPHASH 688914c09063324d2ce71db515e11995
- SHA256 7d4edb3af05551d1da8af2312c1307cb76764124a59c5234a1cbc894c3806c43
- MD5 849805ea6e2b680d982b98c37c66f7bc
- SHA1 cbebaaca98d23674ef1110bed9ba870764a6911b
- SHA512 cf6bb1a0e25d87da992c1c7e68eaec517dac08c673923065f9082736410f68d1551d632ad3bf017a294d0ecce9f52fe307ce101ad67116e9bcd5f31132a67d6d
- SSDEEP 6144:O2yGi46Bq/kHtGjHyfXZkWk0laUGOq6KF3dNwqjr/fcmmsBfftHt:die/syWOOZK/mqjr/fasBfFN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
175296
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\yedaxaza.pdb
kernel32
ExitProcess
GetEnvironmentVariableW
FileTimeToDosDateTime
CreateTimerQueue
SearchPathW
InterlockedDecrement
AddConsoleAliasW
FlushViewOfFile
FreeEnvironmentStringsA
OutputDebugStringW
GetTickCount
GenerateConsoleCtrlEvent
SetFileShortNameW
LoadLibraryW
SetSystemTimeAdjustment
GetModuleFileNameW
CreateActCtxA
CompareStringW
lstrlenW
GetStartupInfoW
OpenMutexW
FindFirstFileExA
GetCurrentDirectoryW
GetLongPathNameW
SetLastError
GetProcAddress
SetVolumeLabelW
SearchPathA
_hwrite
OpenWaitableTimerA
RegisterWaitForSingleObject
OpenWaitableTimerW
LocalAlloc
SetConsoleOutputCP
SetCurrentDirectoryW
WriteProfileSectionW
AddAtomA
GetModuleFileNameA
WTSGetActiveConsoleSessionId
CreateIoCompletionPort
GetModuleHandleA
QueryMemoryResourceNotification
FreeEnvironmentStringsW
RequestWakeupLatency
FillConsoleOutputAttribute
SetProcessShutdownParameters
GetVersionExA
DeleteFileW
CloseHandle
CreateFileW
GetCommandLineW
HeapSetInformation
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedIncrement
DecodePointer
GetModuleHandleW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
IsBadReadPtr
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLastError
HeapCreate
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
GetStringTypeW
MultiByteToWideChar
OutputDebugStringA
WriteConsoleW
WideCharToMultiByte
LCMapStringW
IsProcessorFeaturePresent
RaiseException
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
user32
GetMessagePos
Name
.text
Size
289KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
18.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=171, productName=VS2010 build 30319, version=30319,
count=23, id=158, productName=VS2010 build 30319, version=30319,
count=116, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=117, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,