00648d8195f97b68fb658c75f256f2b4.zip
- SHA256 e489ae6a1b51341c25c741850c4f6e6f82d8241d618b5a082c248788df3ba759
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d572033c59d050ae0a7b6cafa3728a7675721bff18f4087fee4e8d8692c0a974.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
d572033c59d050ae0a7b6cafa3728a7675721bff18f4087fee4e8d8692c0a974.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 00648d8195f97b68fb658c75f256f2b4.zip
- Size 1.1MB
- Sample240831-p2e26stgnn
- SHA256 e489ae6a1b51341c25c741850c4f6e6f82d8241d618b5a082c248788df3ba759
- MD5 495a86ff90134cfb1dc6e945c92253c6
- SHA1 21f63f13247a68a489130635936a73146f7c2f85
- SHA512 74fbedfffbe0e7ae72c8920cb55cb976e7acfe053b0ee939ead0025751dd3cd25b2286de713a897fe7efd22cb9486961b4f6687ee97bc0ea4e3ae13e91a71e47
- SSDEEP 24576:Qgg351GYvnX4SZwfUm+TZJbODLy0HD7CT+X0rvCaLqUGPfvzSbB+rKr:OoYvnoSmfUm+Tjw1BICaf0SbB+rC
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d572033c59d050ae0a7b6cafa3728a7675721bff18f4087fee4e8d8692c0a974
File Explorer
-
00648d8195f97b68fb658c75f256f2b4.zip.zip 1.1MB
-
d572033c59d050ae0a7b6cafa3728a7675721bff18f4087fee4e8d8692c0a974.exe 10.9MB
d572033c59d050ae0a7b6cafa3728a7675721bff18f4087fee4e8d8692c0a974
- IMPHASH 470518591ed4a5fa094199423463cb10
- SHA256 d572033c59d050ae0a7b6cafa3728a7675721bff18f4087fee4e8d8692c0a974
- MD5 00648d8195f97b68fb658c75f256f2b4
- SHA1 e45eb357905049dbfe81ad64a87fe4158392aeab
- SHA512 d70b12a153aa790925c134c638a522190930fc701d6cd45aff119a292d4657c4084fcafb424093d248421e26f2dd728526759e7f93a49147fdec937f7c86923d
- SSDEEP 196608:ITTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTX:
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
97584
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\divanudojuxe-dopuxovitoyu_mipuyaxeb\safo68\ledup.pdb
kernel32
ExitProcess
FileTimeToDosDateTime
CreateTimerQueue
InterlockedIncrement
FlushViewOfFile
OutputDebugStringW
GetProcessPriorityBoost
GetModuleHandleW
GetTickCount
GenerateConsoleCtrlEvent
IsBadReadPtr
GetConsoleAliasesLengthA
CreateActCtxW
GlobalAlloc
SetFileShortNameW
GetSystemTimeAdjustment
GetVersionExW
GetEnvironmentVariableA
CompareStringW
lstrlenW
GetStartupInfoW
FindFirstFileExA
SetLastError
GetProcAddress
GetLongPathNameA
CopyFileA
CreateMemoryResourceNotification
SearchPathA
_hwrite
OpenWaitableTimerA
OpenMutexA
RegisterWaitForSingleObject
OpenWaitableTimerW
SetConsoleOutputCP
SetCurrentDirectoryW
WriteProfileSectionW
AddAtomA
GetModuleFileNameA
WTSGetActiveConsoleSessionId
CreateIoCompletionPort
GetModuleHandleA
GetProcessShutdownParameters
FreeEnvironmentStringsW
FillConsoleOutputAttribute
GetCurrentDirectoryA
CompareStringA
GetVersionExA
AddConsoleAliasA
DeleteFileA
CloseHandle
CreateFileW
SetStdHandle
GetConsoleMode
GetCommandLineW
HeapSetInformation
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedDecrement
DecodePointer
GetModuleFileNameW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLastError
HeapCreate
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
GetStringTypeW
MultiByteToWideChar
OutputDebugStringA
WriteConsoleW
WideCharToMultiByte
LCMapStringW
IsProcessorFeaturePresent
RaiseException
SetFilePointer
GetConsoleCP
FlushFileBuffers
user32
GetMessagePos
winhttp
WinHttpQueryOption
Name
.text
Size
213KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
18.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10.7MB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=171, productName=VS2010 build 30319, version=30319,
count=23, id=158, productName=VS2010 build 30319, version=30319,
count=116, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=119, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,