Static task
static1
Behavioral task
behavioral1
Sample
25ace4204666995da84694fc29d087c704fb42b83adf35966150ea0345a2d561.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
25ace4204666995da84694fc29d087c704fb42b83adf35966150ea0345a2d561.exe
Resource
win10v2004-20240802-en
General
-
Target
25ace4204666995da84694fc29d087c704fb42b83adf35966150ea0345a2d561
-
Size
91KB
-
MD5
c76d95ac1b24b3be444974c67ba73ab7
-
SHA1
a0c1f56a15b486cacfe7835056a97458017821ec
-
SHA256
25ace4204666995da84694fc29d087c704fb42b83adf35966150ea0345a2d561
-
SHA512
a51641d53edb9804fab25bc6db7739de36d9096020b24bfa015152f887c29fad620deea686fbbfc447418a54829b70cd04c94d179d4237de904175f7f9cc7374
-
SSDEEP
1536:kOt15y2yZSqhKclbQ0NiH6zeGwiOmZwQ4PR2aAiwjGB07dQ4gW2:kOxyx9bw6zeGwiOmaQ4Z3KicQ4gW2
Malware Config
Signatures
Files
-
25ace4204666995da84694fc29d087c704fb42b83adf35966150ea0345a2d561.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
4d:3a:df:c3:85:62:b9:5c:0c:a9:ad:ce:b9:8e:9a:63:ff:93:f2:12Certificate
IssuerCN=goulash.tech,O=Goulash.tech,L=Yekaterinburg,ST=Sverdlovsk oblast,C=RUNot Before07/08/2023, 07:02Not After06/08/2033, 07:02SubjectCN=goulash.tech,OU=Codesign,O=Goulash.tech,L=Yekaterinburg,ST=Sverdlovsk oblast,C=RUcf:76:f6:76:a4:16:09:d3:4b:b6:aa:6c:33:4b:a2:59:a6:f5:b2:cd:be:c7:ff:fd:dd:df:ae:15:03:7b:6c:69Signer
Actual PE Digestcf:76:f6:76:a4:16:09:d3:4b:b6:aa:6c:33:4b:a2:59:a6:f5:b2:cd:be:c7:ff:fd:dd:df:ae:15:03:7b:6c:69Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
D:\NewProjects\sushkof\kkmagent\KKMAgent\obj\Release\KKMAgent.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ