f00ca6c492dbbd67bdc91a5bf15fd697.zip
- SHA256 a27ddebd49a1f0c363f420450e1dea9d3fd168381b7e014cba1b515f3d7875aa
Password
infected
Behavioral task
behavioral1
Sample
2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
General
- Target f00ca6c492dbbd67bdc91a5bf15fd697.zip
- Size 544KB
- Sample240901-xqqnjayhrk
- SHA256 a27ddebd49a1f0c363f420450e1dea9d3fd168381b7e014cba1b515f3d7875aa
- MD5 1b8335353d4a456c879b738f5ec54d95
- SHA1 366f91f58d53037cdc9e4eaa51407438f11b255b
- SHA512 f3199295a856a97c8ce4f80dc3c7cfc5310e16ef3f4a4376378bf1b1be7b75080419106f5ba3d39d1df061fdf898233ce242a289fd951b9c37f2d1232f88a0fa
- SSDEEP 12288:2wt2wyxfvxXGKA2Ni32Xgr/UWZXIiuYgfjFicdr0sTfqLUW/OvE:D29fpXG7DmQcWZXuEu0IhTvE
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Urelas family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257
File Explorer
-
f00ca6c492dbbd67bdc91a5bf15fd697.zip.zip 544KB
-
2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257.exe 1.1MB
2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257
- IMPHASH 00d8178937161dc240e0095e46c6ce52
- SHA256 2cd90c12f59227b2a93dbb7b29a9d609e3ae6255189f9b2bb367b09fc849a257
- MD5 f00ca6c492dbbd67bdc91a5bf15fd697
- SHA1 aa8244a42eb8e56dc67e0f52940d300e20b57423
- SHA512 68f6bf042d9e05c1d1150f69dcfd2a989fddf1eba55d6ed40d0f2a9fb814a046f78fff45269af00f6be16a87734f330266fb40119fe641fb17c0bb366ebbadc7
- SSDEEP 12288:tEr6bkpYN2jF7vQZmSohg+k7j6aDG4FuA6lpgTIJcqBZ5YZ:tcykpY5852j6aJGl5cqBe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
52537
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
CreateEventW
CreateThread
GetSystemDirectoryW
DeleteFileW
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
MultiByteToWideChar
GetVersionExW
CreateFileW
GetFileSizeEx
GetLastError
GetCurrentProcessId
TerminateProcess
GetModuleHandleA
GetProcAddress
GetTempPathA
GetModuleFileNameA
CreateFileA
WriteFile
ReadFile
SetFilePointer
OpenEventW
DeviceIoControl
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
WideCharToMultiByte
SetFileAttributesW
SetEndOfFile
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
CopyFileW
GetTempPathW
GetFileAttributesW
Sleep
GetTickCount
ExitProcess
FlushFileBuffers
GetModuleFileNameW
SetStdHandle
InitializeCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
RaiseException
GetConsoleMode
GetConsoleCP
HeapCreate
HeapDestroy
HeapReAlloc
HeapAlloc
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
VirtualFree
VirtualAlloc
user32
LoadStringW
LoadAcceleratorsW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
wsprintfW
DialogBoxParamW
DestroyWindow
DefWindowProcW
EndDialog
PostQuitMessage
EndPaint
BeginPaint
advapi32
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
shell32
ShellExecuteW
ShellExecuteA
ws2_32
htonl
connect
WSAGetLastError
recv
send
WSAStartup
closesocket
gethostbyaddr
socket
gethostbyname
inet_addr
htons
iphlpapi
GetAdaptersInfo
Name
.text
Size
656KB
Virtual Size
656KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
504KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=53, id=110, productName=VS2005 build 50727, version=50727,
count=23, id=125, productName=VS2005 build 50727, version=50727,
count=145, id=109, productName=VS2005 build 50727, version=50727,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=179, id=1, productName=Unmarked objects,
count=18, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,