4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.zip
- SHA256 37a6006013b8ae6b136b4dbb44ba232de94e1bed2197a7243e9143cd3a18fffb
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.zip
- Size 619KB
- Sample240909-ntpe7swbpp
- SHA256 37a6006013b8ae6b136b4dbb44ba232de94e1bed2197a7243e9143cd3a18fffb
- MD5 923286a83c76e39fe35d0206733ccfb6
- SHA1 5ec5fc824b383e68605df8aca793f5d8acaae7c0
- SHA512 d3a77fa5a94d501f5a90cc9f717c0847173785d1220ec83ef21d5218b220ebaf76e3ee48ba51719b8afed5f9f8b305514ffddd4438177d8173e19760693e1f46
- SSDEEP 12288:MrN2J9PuUmiJ9Z3kx80iaS/gimGwhUU0S2bmjStlPU31Vgw16vsuZ/zh:MuP5mitkxQaRiUUUqft9U31Vx6vs2
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
File Explorer
-
4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.zip.zip 619KB
-
4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe.exe 837KB
4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
- IMPHASH 694d481161f15a3a50297f304cce5a11
- SHA256 4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981
- MD5 b3757b09ed2150ce857f446c0c61363c
- SHA1 04536100a4a8fc27dde91e006f4e2ea6b398b65e
- SHA512 c7fb0efb95a96177bcbc50a60f2d900f4f7328a0a98a64ead6fc6e00f52502c904815e1e0a8b309a764c77db1fa65a8e5da5104593e0d987fb6bf3f794a82119
- SSDEEP 24576:c3eL/rX2Ev8KDHwSPxDwauHfz/eicEeb+8TYLL:NLz7x7PP+H7e0YfT4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8292
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
EnumResourceNamesW
HeapCompact
SetEndOfFile
LocalCompact
CreateHardLinkA
GlobalAlloc
LoadLibraryW
ReadConsoleInputA
IsBadWritePtr
IsBadStringPtrA
GlobalUnlock
GetLastError
SetLastError
GetProcAddress
CreateJobSet
LoadLibraryA
SetConsoleCtrlHandler
AddAtomW
CreateEventW
HeapLock
EnumResourceTypesW
GetModuleFileNameA
GetOEMCP
GetCurrentDirectoryA
GetFileTime
GetCurrentThreadId
Module32NextW
GetDiskFreeSpaceExW
TerminateJobObject
DebugBreak
CreateFileW
WriteConsoleW
CloseHandle
FlushFileBuffers
GetConsoleMode
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
ExitProcess
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
HeapFree
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
ReadFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
Sleep
MultiByteToWideChar
SetFilePointer
RtlUnwind
GetCPInfo
GetACP
IsValidCodePage
WideCharToMultiByte
HeapSize
HeapReAlloc
SetStdHandle
LCMapStringW
GetStringTypeW
GetConsoleCP
RaiseException
user32
GetKeyboardLayout
CharUpperBuffA
SetCursorPos
LoadMenuW
GetSysColorBrush
GetSystemMetrics
SetCaretPos
GetMessageTime
Name
.text
Size
637KB
Virtual Size
636KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
147KB
Virtual Size
28.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.yug
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ruwuvoh
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=27, id=171, productName=VS2010 build 30319, version=30319,
count=19, id=158, productName=VS2010 build 30319, version=30319,
count=87, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,