d5765dff5690f5f9a337c9fa0047b8c58e9f2ec2b6211f8482d57c5bf251308c

General

Target
d5765dff5690f5f9a337c9fa0047b8c58e9f2ec2b6211f8482d57c5bf251308c
Size 7.8MB
Sample240902-d7t8ha1grd
SHA256 d5765dff5690f5f9a337c9fa0047b8c58e9f2ec2b6211f8482d57c5bf251308c
MD5 bb7fc0972dc54c71ba4fa058194290d8
SHA1 0618385f3aedcfd2818aef5c07e5dbc995192910
SHA512 a954f0034dfffde83c86fed5cf7c32ed74017b685ceedae45c209eee61bc0508ad7ec8f62df5f5664b26b36760658540b1287dd4169aeb6c96e9429c5b65222d
SSDEEP 196608:bcpJ5Ohc+qCVmZjhPLoXY0eJY0h3SDUawhZSl:Qp4c+qCghP8Xdf0h3SlwhZQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/23f1145599ca4f2836be5ba2ef445c06709df2e71dc30d6cd534b60810673716

File Explorer

d5765dff5690f5f9a337c9fa0047b8c58e9f2ec2b6211f8482d57c5bf251308c

.zip 7.8MB
23f1145599ca4f2836be5ba2ef445c06709df2e71dc30d6cd534b60810673716

.exe 11.3MB

d5765dff5690f5f9a337c9fa0047b8c58e9f2ec2b6211f8482d57c5bf251308c

SHA256 d5765dff5690f5f9a337c9fa0047b8c58e9f2ec2b6211f8482d57c5bf251308c
MD5 bb7fc0972dc54c71ba4fa058194290d8
SHA1 0618385f3aedcfd2818aef5c07e5dbc995192910
SHA512 a954f0034dfffde83c86fed5cf7c32ed74017b685ceedae45c209eee61bc0508ad7ec8f62df5f5664b26b36760658540b1287dd4169aeb6c96e9429c5b65222d
SSDEEP 196608:bcpJ5Ohc+qCVmZjhPLoXY0eJY0h3SDUawhZSl:Qp4c+qCghP8Xdf0h3SlwhZQ
MD5 SHA1 SHA512 SSDEEP

Password

infected

23f1145599ca4f2836be5ba2ef445c06709df2e71dc30d6cd534b60810673716

IMPHASH 613eed189326e5150348769c0b41fcc9
SHA256 23f1145599ca4f2836be5ba2ef445c06709df2e71dc30d6cd534b60810673716
MD5 d318dc7b92c68cddb6ac8e82af8a7439
SHA1 c6fd11ca5e592b4992663d210b0c622e47c6697c
SHA512 e44a44fe52d6017ef83aa569ca6c0277e0c8dd09f255e3b68fbbc032703ce8deee7f40c887abfe3feac291e63baa62e04098ad43ab15e2df3476cc731995c945
SSDEEP 98304:9EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEU:
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mogaduhesutun\hihekeyolo63-pi.pdb

kernel32

lstrlenA HeapAlloc EndUpdateResourceW ReadConsoleA GetCurrentProcess SetEvent SleepEx BackupSeek CreateActCtxW GetEnvironmentStrings InitAtomTable HeapDestroy GetFileAttributesA FindNextVolumeW GetTapePosition WriteConsoleW GetModuleFileNameW ReleaseSemaphore DeactivateActCtx InterlockedExchange GetLastError GetProcAddress BeginUpdateResourceW RemoveDirectoryA GetProcessVersion LocalAlloc CreateIoCompletionPort GetModuleHandleA VirtualProtect SetProcessShutdownParameters GetCurrentProcessId FindNextVolumeA lstrcpyA GetCommandLineW HeapSetInformation GetStartupInfoW HeapFree SetFilePointer EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess CloseHandle GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers Sleep RtlUnwind LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException MultiByteToWideChar HeapReAlloc IsProcessorFeaturePresent HeapSize LCMapStringW GetStringTypeW CreateFileW

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lipafo

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.yowo

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11.2MB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d5765dff5690f5f9a337c9fa0047b8c58e9f2ec2b6211f8482d57c5bf251308c

23f1145599ca4f2836be5ba2ef445c06709df2e71dc30d6cd534b60810673716

kernel32

generic