9bbae99548d3a1a1ba72ebd1354f999afeffe25d9d482137185c018653e3133c
- SHA256 9bbae99548d3a1a1ba72ebd1354f999afeffe25d9d482137185c018653e3133c
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42.exe
Resource
win11-20240802-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 9bbae99548d3a1a1ba72ebd1354f999afeffe25d9d482137185c018653e3133c
- Size 413KB
- Sample240905-bzmsca1hkb
- SHA256 9bbae99548d3a1a1ba72ebd1354f999afeffe25d9d482137185c018653e3133c
- MD5 866fa55099a94c8e770fb54503c3c528
- SHA1 b03750cd55b27619451b9d0adb96aa5c184dc19d
- SHA512 58c5f2eddd13cb632c5053c312c2fc56ff41e71795f93a8c88b7b062e8aefda668ee5367bc406c5e3193d010815d0ad1d757666251016e927db5b572d3aa0dd4
- SSDEEP 6144:XvYrrpCZULuR4K133ZrrJ6worfgjeQaQiQD89vLEIs9IeAvRiJPQJRczxrh:wxC6KR4KCBcMZQw9v3s9k1cVrh
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42.exe
File Explorer
-
9bbae99548d3a1a1ba72ebd1354f999afeffe25d9d482137185c018653e3133c.zip 413KB
-
988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42.exe.exe 1.0MB
988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42.exe
- IMPHASH 9b9e1545a27f74c7e825990e6d713212
- SHA256 988776358d0e45a4907dc1f4906a916f1b3595a31fa44d8e04e563a32557eb42
- MD5 4aecef9ddc8d07b82a6902b27f051f34
- SHA1 8ad1b4ed98794e8f0a9a9d6fc161697974099d91
- SHA512 605fb600668cbadb0f556589f923209def1cd3c51b123f4ce7a5325722bcca05f6bb3b26bf7a6aa52bffabe6129c508b302e85ee0a120bedd96a71a105eae437
- SSDEEP 12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdYf:Vpp+Q+u5bUI8pij1NkshdMf99etb5m
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
577624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
WaitForSingleObject
PostQueuedCompletionStatus
GetLastError
SetEvent
TerminateThread
TlsAlloc
CloseHandle
QueueUserAPC
LocalFree
DeleteCriticalSection
TlsFree
FormatMessageA
ReadFile
GetFileSizeEx
SetWaitableTimer
TlsSetValue
SetLastError
WriteFile
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
GetCurrentThreadId
CreateEventW
SetFileInformationByHandle
DeleteFileW
CancelIoEx
SleepEx
TlsGetValue
CreateIoCompletionPort
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetDriveTypeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetCommandLineW
GetStdHandle
WriteConsoleA
GetDynamicTimeZoneInformation
Sleep
GetConsoleMode
GetFileAttributesA
GetSystemInfo
GetCurrentProcessId
GetCurrentProcess
GetProcessId
OpenProcess
ResetEvent
GetLogicalDriveStringsW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapSize
GetLocaleInfoEx
RtlPcToFileHeader
RaiseException
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetStringTypeW
WaitForSingleObjectEx
GetExitCodeThread
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapReAlloc
RtlUnwind
shell32
CommandLineToArgvW
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
ws2_32
WSAStartup
WSACleanup
shlwapi
PathIsNetworkPathW
mpr
WNetGetConnectionW
wtsapi32
WTSEnumerateProcessesW
WTSFreeMemory
rstrtmgr
RmShutdown
RmStartSession
RmRegisterResources
RmGetList
RmEndSession
Name
.text
Size
812KB
Virtual Size
811KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
165KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
33KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=27412,
count=19, id=260, version=27412,
count=181, id=261, version=27412,
count=1, id=262, version=27412,
count=16, id=260, version=32533,
count=10, id=259, version=32533,
count=3, id=261, version=32822,
count=23, id=260, version=32822,
count=100, id=261, version=32533,
count=19, id=257, version=27412,
count=205, id=1, productName=Unmarked objects,
count=9, id=265, version=32822,
count=1, id=255, version=32822,
count=1, id=258, version=32822,