General

  • Target

    4d8424a19bb8ce7a1f6edf42f7c73ae22c760ed12d9a1cb654893637cd19bfcdN

  • Size

    355KB

  • MD5

    0af7ed788e58bab707d61763c27c3960

  • SHA1

    eff0db3949c99c776c30673f2cfbce3aa4ca7b2a

  • SHA256

    4d8424a19bb8ce7a1f6edf42f7c73ae22c760ed12d9a1cb654893637cd19bfcd

  • SHA512

    02613e23a407ed0156b0435f8b49e39f4a472e30130352d33033eee710912557fd465be28be64f3de3dcb4d2cd5cd3ad7086a0136d9177ff267657735b0a8a17

  • SSDEEP

    6144:m3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eif:xmWhND9yJz+b1FcMLmp2ATTSsdf

Score
10/10

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Simda family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 4d8424a19bb8ce7a1f6edf42f7c73ae22c760ed12d9a1cb654893637cd19bfcdN
    .exe windows:5 windows x86 arch:x86

    173abfa8f7d7adac2a90a2e42625b7d9


    Headers

    Imports

    Sections