a85c2fc35c54dceffc9fc852d137ac719c767e45a967693da54882c9f250413c

General

Target
a85c2fc35c54dceffc9fc852d137ac719c767e45a967693da54882c9f250413c
Size 449KB
Sample240902-bbweksxgne
SHA256 a85c2fc35c54dceffc9fc852d137ac719c767e45a967693da54882c9f250413c
MD5 599c017e8fd78f8af864c8e82dc2e5fa
SHA1 d14193e47fde99e222b14db28728430e446425f1
SHA512 5388f2daf90a414d6a4bae77550ed104d3cb665f8a06c48b7951bacee6e3b39e9ebef2f07b5df91305b88d2b99d95df6baa8f9ce0790436d52a1d8fbc1f47da9
SSDEEP 12288:e+nP4S+qaK+ISAnvb4AaKUP0HWb01mYIECXG:bnAS+hF5Avhacw0wqF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/75b40afc06895b53f4a90d06c0b6b0e6b72a2c34883dfd151bfbac51701576c0

File Explorer

a85c2fc35c54dceffc9fc852d137ac719c767e45a967693da54882c9f250413c

.zip 449KB
75b40afc06895b53f4a90d06c0b6b0e6b72a2c34883dfd151bfbac51701576c0

.exe 539KB

a85c2fc35c54dceffc9fc852d137ac719c767e45a967693da54882c9f250413c

SHA256 a85c2fc35c54dceffc9fc852d137ac719c767e45a967693da54882c9f250413c
MD5 599c017e8fd78f8af864c8e82dc2e5fa
SHA1 d14193e47fde99e222b14db28728430e446425f1
SHA512 5388f2daf90a414d6a4bae77550ed104d3cb665f8a06c48b7951bacee6e3b39e9ebef2f07b5df91305b88d2b99d95df6baa8f9ce0790436d52a1d8fbc1f47da9
SSDEEP 12288:e+nP4S+qaK+ISAnvb4AaKUP0HWb01mYIECXG:bnAS+hF5Avhacw0wqF
MD5 SHA1 SHA512 SSDEEP

Password

infected

75b40afc06895b53f4a90d06c0b6b0e6b72a2c34883dfd151bfbac51701576c0

IMPHASH 95764cd3a93b27321012d20c57632d43
SHA256 75b40afc06895b53f4a90d06c0b6b0e6b72a2c34883dfd151bfbac51701576c0
MD5 788f45ada2b264a9ea458f7d125571b0
SHA1 cc7cbce75f3f0c2e9eeb5c16f3b0cb690aa46aad
SHA512 7151982e5270c10869a1bbeb8329ec884aff1ec46925fe0bbbe07c70c3c279fe41c48fbf56835fece6341db772fdd98b142dab66d0d84e3f70422906d74de181
SSDEEP 12288:cFLz8rA4TmF2Gfhk0AYumXdw/9ZO9gEwZGEX8cA0/M:Sk3TORlAYumXo9ZO9ssEv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mecefejabax_dunugogi\27\lupuwi\xomahofo\vudidoloto\94\buk.pdb

kernel32

HeapAlloc GetCurrentProcess GetEnvironmentStringsW SetEvent FlushViewOfFile SleepEx ReadConsoleW InitAtomTable HeapDestroy WriteConsoleW GetModuleFileNameW CreateActCtxA DeactivateActCtx GetProcAddress BeginUpdateResourceW GetAtomNameA LocalAlloc SetEnvironmentVariableA GetOEMCP CreateIoCompletionPort SetConsoleTitleW GetModuleHandleA GetProcessShutdownParameters EraseTape VirtualProtect GetCPInfoExA Module32Next ReleaseMutex EndUpdateResourceA GetVersionExA FindNextVolumeA lstrcpyW LCMapStringW SetLastError SetProcessAffinityMask IsProcessorFeaturePresent HeapReAlloc EncodePointer DecodePointer GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId GetLastError InterlockedDecrement ReadFile HeapFree SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP IsValidCodePage CloseHandle LoadLibraryW WriteFile FreeEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte GetConsoleCP GetConsoleMode Sleep MultiByteToWideChar SetStdHandle RtlUnwind FlushFileBuffers GetStringTypeW HeapSize RaiseException CreateFileW

user32

ClientToScreen

gdi32

GetBitmapBits

winhttp

WinHttpSetOption

Sharing

General

Malware Config

Signatures

File Explorer

a85c2fc35c54dceffc9fc852d137ac719c767e45a967693da54882c9f250413c

75b40afc06895b53f4a90d06c0b6b0e6b72a2c34883dfd151bfbac51701576c0

kernel32

user32

gdi32

winhttp

generic