82aa9a86e40c08cd9fb8a692485ed58cd00e737747da32b80b7cd93809ef7de5
- SHA256 82aa9a86e40c08cd9fb8a692485ed58cd00e737747da32b80b7cd93809ef7de5
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 82aa9a86e40c08cd9fb8a692485ed58cd00e737747da32b80b7cd93809ef7de5
- Size 183KB
- Sample240831-qeadvavfka
- SHA256 82aa9a86e40c08cd9fb8a692485ed58cd00e737747da32b80b7cd93809ef7de5
- MD5 5850e3ef75111d249490ac0293593eb5
- SHA1 56d93968aebe60cecf34fb753dc43255e903279a
- SHA512 d078ff59eeeb2cdcf9a8e3dbfda250f1e17c4b08f86d837ecac999b36d2ff93f227ec349cfc6c51e579cb5ab4972e0c230f34da0b2518dcd31ff61d2aed212f4
- SSDEEP 3072:1Rl4Z+a9DccXDqFqiPvQeRb1qJWYeTWEXGv7ON+pPoUPa8B+OLFRnPvkS/dvbPNP:1LJ4KNV5NuPoU+OLrLbiwl
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd
File Explorer
-
82aa9a86e40c08cd9fb8a692485ed58cd00e737747da32b80b7cd93809ef7de5.zip 183KB
-
072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd.exe 13.6MB
072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd
- IMPHASH 6f5d0ff7ce2dce34369bbebe37660ec9
- SHA256 072e795c44b87d1eb54005be791e75db47cb9717e43b300d3e27b6c9d99523fd
- MD5 b5b559ae20ec80c26ec50afd2d077f53
- SHA1 4553fc5937302711ee5e74a881c7fd4acd119e5b
- SHA512 dadb525483641f1574c5efcb48cc2c1333d34145b1b7e6386afa9f3e64db7ce45bbe4fc70f2656a997ec42e839bc73cb4c641bd97061e95d712c476f5573cdfd
- SSDEEP 196608:aI+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++2:a
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7264
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\fusobik\tac.pdb
kernel32
GetCommandLineW
GetThreadContext
SearchPathW
SetInformationJobObject
FindFirstChangeNotificationW
lstrlenA
CopyFileExW
InterlockedIncrement
GetQueuedCompletionStatus
GetSystemWindowsDirectoryW
GetProfileStringW
SetConsoleScreenBufferSize
CallNamedPipeW
FreeEnvironmentStringsA
SetTapeParameters
CreateNamedPipeW
GetCompressedFileSizeW
SetCommState
CreateActCtxW
FindResourceExA
SetFileShortNameW
LoadLibraryW
SizeofResource
GetSystemWow64DirectoryW
HeapDestroy
CreateSemaphoreA
GetBinaryTypeA
GetModuleFileNameW
GetSystemDirectoryA
GetStartupInfoW
LCMapStringA
GetPrivateProfileIntW
GetLastError
SetLastError
GetProcAddress
SetStdHandle
LocalAlloc
GetNumberFormatW
FindAtomA
FindNextFileA
CreateIoCompletionPort
HeapSetInformation
GetCurrentDirectoryA
OutputDebugStringA
GetCPInfoExA
FindAtomW
DeleteFileW
GetSystemTime
InterlockedDecrement
DecodePointer
GetModuleHandleW
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
WriteFile
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapValidate
IsBadReadPtr
HeapCreate
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
WriteConsoleW
OutputDebugStringW
MultiByteToWideChar
GetStringTypeW
LCMapStringW
HeapAlloc
GetModuleFileNameA
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
IsProcessorFeaturePresent
FlushFileBuffers
ReadFile
RaiseException
CreateFileW
CloseHandle
Name
.text
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
68KB
Virtual Size
4.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13.4MB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=171, productName=VS2010 build 30319, version=30319,
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=105, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=116, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,