46912015f4e217c84f81982305c8c6d5.zip
- SHA256 f8d31e6775488ad2285818fdd4b9bb4f1480a453758a29a3755f4376954e8644
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 46912015f4e217c84f81982305c8c6d5.zip
- Size 1.3MB
- Sample240901-antabathrd
- SHA256 f8d31e6775488ad2285818fdd4b9bb4f1480a453758a29a3755f4376954e8644
- MD5 91be4687221e85f24b29305c629783db
- SHA1 18b90d4fe92d079565ffcfc2100072bbed3dfe5d
- SHA512 8b4e29269c8abb77721f29ab469bf4b5091eda124b3315afdbc8e1e3665e44ec78bcbba86413f00c6f0d38f7a64b8c98a8138070dd1b3ca71e2370f176347ac1
- SSDEEP 24576:mZ5vHFx1GnGTb3BDYWoHnpH/p90gSm4sU220r+Qnsz56UGSNWAq8rWH:uDwSb3BDYWIpH/p+Jsy0r+QrUWtH
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e
File Explorer
-
46912015f4e217c84f81982305c8c6d5.zip.zip 1.3MB
-
29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e.exe 13.5MB
29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e
- IMPHASH 470518591ed4a5fa094199423463cb10
- SHA256 29b0f91a35ae86daabb6e62bde864cf514549d1d3e9f0fa453521fccd389d51e
- MD5 46912015f4e217c84f81982305c8c6d5
- SHA1 ba7ccd3f4668126eed2a609eb6ac489e9893b78a
- SHA512 83900686d98969d7a00a1b78a3e1f7aeba2b95d8f931f412787a03fd32d87dfbfeb1d0506b2a2190254b0fa88e235264e58374b353d0a5c68f0c299f7782b17e
- SSDEEP 49152:fyzapZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZx:fC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
99216
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\militayizita\risuvimuv\hut.pdb
kernel32
ExitProcess
FileTimeToDosDateTime
CreateTimerQueue
InterlockedIncrement
FlushViewOfFile
OutputDebugStringW
GetProcessPriorityBoost
GetModuleHandleW
GetTickCount
GenerateConsoleCtrlEvent
IsBadReadPtr
GetConsoleAliasesLengthA
CreateActCtxW
GlobalAlloc
SetFileShortNameW
GetSystemTimeAdjustment
GetVersionExW
GetEnvironmentVariableA
CompareStringW
lstrlenW
GetStartupInfoW
FindFirstFileExA
SetLastError
GetProcAddress
GetLongPathNameA
CopyFileA
CreateMemoryResourceNotification
SearchPathA
_hwrite
OpenWaitableTimerA
OpenMutexA
RegisterWaitForSingleObject
OpenWaitableTimerW
SetConsoleOutputCP
SetCurrentDirectoryW
WriteProfileSectionW
AddAtomA
GetModuleFileNameA
WTSGetActiveConsoleSessionId
CreateIoCompletionPort
GetModuleHandleA
GetProcessShutdownParameters
FreeEnvironmentStringsW
FillConsoleOutputAttribute
GetCurrentDirectoryA
CompareStringA
GetVersionExA
AddConsoleAliasA
DeleteFileA
CloseHandle
CreateFileW
SetStdHandle
GetConsoleMode
GetCommandLineW
HeapSetInformation
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedDecrement
DecodePointer
GetModuleFileNameW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLastError
HeapCreate
WriteFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
GetStringTypeW
MultiByteToWideChar
OutputDebugStringA
WriteConsoleW
WideCharToMultiByte
LCMapStringW
IsProcessorFeaturePresent
RaiseException
SetFilePointer
GetConsoleCP
FlushFileBuffers
user32
GetMessagePos
winhttp
WinHttpQueryOption
Name
.text
Size
214KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
18.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13.3MB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=44, id=171, productName=VS2010 build 30319, version=30319,
count=23, id=158, productName=VS2010 build 30319, version=30319,
count=116, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=119, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,