03778d811f241e83ccad830372313b3c[.]zip

General

Target
03778d811f241e83ccad830372313b3c.zip
Size 6.0MB
Sample240901-sbyndavbmf
SHA256 75a58e896b1e5f70dceb2bc8e189ec19f600cb2df28196af4ba05711bea7ce3f
MD5 cb5f90bc4f6b3efb5a8d8d96919922fb
SHA1 2957561a29587d510fd9a40e479416c80203cd6c
SHA512 80d32637b5f660704b182c94a17a668aad0686b5fe3c7aa70dc66b1d9c7815d7e73ecbe29ce0cec09ce9ad421dce58f24a723d48acd4f2fa486fc913412dd027
SSDEEP 98304:Yvo1nQ0HP4N8GMZbAOr6/uWM3OY6vqQMOpoT4YOYDGAZfkSJJVjnhRD2wOMTjnXK:SoJQ+P4be9r3z6iQMuYDTKKDjnhpTLXK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

agilenet

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
static1/unpack001/95246179cf7c6c8d3629dd30eb1b76bfff221c82915eed1b77c05daa8c5a0afc	agile_net

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/95246179cf7c6c8d3629dd30eb1b76bfff221c82915eed1b77c05daa8c5a0afc

File Explorer

03778d811f241e83ccad830372313b3c.zip

.zip 6.0MB
95246179cf7c6c8d3629dd30eb1b76bfff221c82915eed1b77c05daa8c5a0afc

.exe 6.1MB

03778d811f241e83ccad830372313b3c.zip

SHA256 75a58e896b1e5f70dceb2bc8e189ec19f600cb2df28196af4ba05711bea7ce3f
MD5 cb5f90bc4f6b3efb5a8d8d96919922fb
SHA1 2957561a29587d510fd9a40e479416c80203cd6c
SHA512 80d32637b5f660704b182c94a17a668aad0686b5fe3c7aa70dc66b1d9c7815d7e73ecbe29ce0cec09ce9ad421dce58f24a723d48acd4f2fa486fc913412dd027
SSDEEP 98304:Yvo1nQ0HP4N8GMZbAOr6/uWM3OY6vqQMOpoT4YOYDGAZfkSJJVjnhRD2wOMTjnXK:SoJQ+P4be9r3z6iQMuYDTKKDjnhpTLXK
MD5 SHA1 SHA512 SSDEEP

Password

infected

95246179cf7c6c8d3629dd30eb1b76bfff221c82915eed1b77c05daa8c5a0afc

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 95246179cf7c6c8d3629dd30eb1b76bfff221c82915eed1b77c05daa8c5a0afc
MD5 03778d811f241e83ccad830372313b3c
SHA1 11962399abf7fc0981f324e4aa5271f36f50c5ba
SHA512 2e17b881491e2cc9759dde852198622956682327abcc20519ab7099e25b22252a167cd7a4e6e90651a8b44b22c89a52c8fd004a62043f8fa30fe523302f6674f
SSDEEP 98304:ulFqmwupyhcHp5ooEAnHRVN07KgHDpS18DqBRe7qxKfT1J+tNY3LU4rI2qo:uWJuMg53HRVu7vHDpS1IqBRU7kCs2q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

6353182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\intel\Downloads\AVB\AVB\AVB\obj\Debug\AVB.pdb

03778d811f241e83ccad830372313b3c.zip

95246179cf7c6c8d3629dd30eb1b76bfff221c82915eed1b77c05daa8c5a0afc

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

03778d811f241e83ccad830372313b3c.zip

95246179cf7c6c8d3629dd30eb1b76bfff221c82915eed1b77c05daa8c5a0afc

mscoree

dotnet