0f96858bafeb8465312ec417adfafa5a.zip
- SHA256 3448e29b943ccc42758cfa62d39c7a71f036007e75a7a97831d65f4b290076ce
Password
infected
Behavioral task
behavioral1
Sample
fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
150 seconds
General
- Target 0f96858bafeb8465312ec417adfafa5a.zip
- Size 187KB
- Sample240831-p68v2svbmd
- SHA256 3448e29b943ccc42758cfa62d39c7a71f036007e75a7a97831d65f4b290076ce
- MD5 2bc8136f91d20b06c287af7878b06d42
- SHA1 52d7ecee6f1ad266b8b313ab60f4052f60784e71
- SHA512 d07aea2454c043d312766581a3e4545a7a8a04f91210c8fc45c6b3a2bb43b57f002afc6d6ee5407ff2d3d4f2768a1a202c14ce272dbcf37a675e51673c490d73
- SSDEEP 3072:Y2FVeRHaKPm9zHBZrimjXxwPHtPQmw/uHa25uZtKlfhzMruMkZCZQj+:Y2apaKulymINYPU9IZkthzMjkZCGK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Urelas family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d
File Explorer
-
0f96858bafeb8465312ec417adfafa5a.zip.zip 187KB
-
fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d.exe 349KB
fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d
- IMPHASH 1a7336ed8b77b7e34502eccb0e5ec8d2
- SHA256 fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d
- MD5 0f96858bafeb8465312ec417adfafa5a
- SHA1 d81cdb2ff5d51950a3482135c7a667d5f5cc60cc
- SHA512 47fc6857db288f37824f2d484ed048549e011b23dbebfb3c9130708645339e58f4a1031ed2a74ecfc0d7e21dce9f1c7d7d2a1779a24c2868dc60f29f47af3288
- SSDEEP 6144:c/bE5G5KiR0J0dCsnGb/6VOpLc91WlvhDSNZI0:A0G5obGGraOpUWlpO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
12825
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
CreateEventW
CreateThread
GetSystemDirectoryW
DeleteFileW
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
MultiByteToWideChar
GetVersionExW
CreateFileW
GetFileSizeEx
GetLastError
GetCurrentProcessId
TerminateProcess
GetModuleHandleA
GetProcAddress
GetTempPathA
GetModuleFileNameA
CreateFileA
WriteFile
ReadFile
SetFilePointer
OpenEventW
DeviceIoControl
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
WideCharToMultiByte
CreateDirectoryW
SetFileAttributesW
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
CopyFileW
GetTempPathW
GetFileAttributesW
Sleep
GetTickCount
ExitProcess
FlushFileBuffers
GetModuleFileNameW
SetStdHandle
InitializeCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
RaiseException
GetConsoleMode
GetConsoleCP
HeapCreate
HeapDestroy
HeapReAlloc
HeapAlloc
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
VirtualFree
VirtualAlloc
user32
LoadStringW
LoadAcceleratorsW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
wsprintfW
DialogBoxParamW
DestroyWindow
DefWindowProcW
EndDialog
PostQuitMessage
EndPaint
BeginPaint
advapi32
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
shell32
ShellExecuteW
ShellExecuteA
ws2_32
htonl
connect
WSAGetLastError
recv
send
WSAStartup
closesocket
gethostbyaddr
socket
gethostbyname
inet_addr
htons
iphlpapi
GetAdaptersInfo
Name
.text
Size
110KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
6KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
JHDFRWG
Size
50KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=23, id=125, productName=VS2005 build 50727, version=50727,
count=145, id=109, productName=VS2005 build 50727, version=50727,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=179, id=1, productName=Unmarked objects,
count=18, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,