b66fb905a3acf8487e0a87c3ccd45a96a9e1757bfb80c69ee7c7c27af4710d70

General

Target
b66fb905a3acf8487e0a87c3ccd45a96a9e1757bfb80c69ee7c7c27af4710d70
Size 602KB
Sample241104-rn38ys1cpd
SHA256 b66fb905a3acf8487e0a87c3ccd45a96a9e1757bfb80c69ee7c7c27af4710d70
MD5 a81e9954f8fe6c9f753ecaba38b9e1b2
SHA1 106b178881c5b84e29ee0c522ba629a94674348a
SHA512 658c5605eeb03daebb0e91b80c1f58022f51a5fb262091d56f0c8bb95c5bb997d8950bd0a1c09d06d4e54580c8e06bd3cc07cf5fd512c02225157173e80a874d
SSDEEP 12288:j/IeUusbV9vLPyydkF5H+tJPnHGpVj3wf0kOpZ8s:jQoG9Gyene3nH63wfmpZt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf.exe

File Explorer

b66fb905a3acf8487e0a87c3ccd45a96a9e1757bfb80c69ee7c7c27af4710d70

.zip 602KB
63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf.exe

.exe 723KB

b66fb905a3acf8487e0a87c3ccd45a96a9e1757bfb80c69ee7c7c27af4710d70

SHA256 b66fb905a3acf8487e0a87c3ccd45a96a9e1757bfb80c69ee7c7c27af4710d70
MD5 a81e9954f8fe6c9f753ecaba38b9e1b2
SHA1 106b178881c5b84e29ee0c522ba629a94674348a
SHA512 658c5605eeb03daebb0e91b80c1f58022f51a5fb262091d56f0c8bb95c5bb997d8950bd0a1c09d06d4e54580c8e06bd3cc07cf5fd512c02225157173e80a874d
SSDEEP 12288:j/IeUusbV9vLPyydkF5H+tJPnHGpVj3wf0kOpZ8s:jQoG9Gyene3nH63wfmpZt
MD5 SHA1 SHA512 SSDEEP

Password

infected

63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf.exe

IMPHASH 573b4b7efb3441aeba723c69e52e8c67
SHA256 63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf
MD5 9f0558c26402917e96a9b47632718c97
SHA1 0dff7c168f8b38667b10174854df177062681d1a
SHA512 2dbfda84b019135b156c85de74cfbe55d1e6eb5bf91c874472f8312fa437eeee0e88fbcb2a9d4cb97aba03e321a0894fbea92de238039d63154eb74eb270fc13
SSDEEP 12288:bPHlKPGwVTTl9OHeVLZWsV5PRkKwLDxY8krRdq72FVxPwt6qQ6TjD:DlKPVTl9IeVdt9RkMdd9JwTn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

20104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\sayuyexup.pdb

kernel32

CallNamedPipeA GlobalAddAtomA InterlockedIncrement VerSetConditionMask OpenJobObjectA FindCloseChangeNotification GetModuleHandleW GetConsoleAliasesA FindResourceExA GlobalAlloc SetCommConfig GetConsoleAliasExesLengthW FormatMessageW GetFileAttributesA lstrcpynW WriteConsoleW GetBinaryTypeA MultiByteToWideChar GetStringTypeExA SetLastError GetProcAddress VirtualAlloc LoadLibraryA GetFileType WriteProfileSectionW FindAtomA FoldStringA EnumDateFormatsA CancelTimerQueueTimer FreeEnvironmentStringsW GetStringTypeW GetWindowsDirectoryW GlobalReAlloc LCMapStringW EnumSystemLocalesA GetDateFormatW GetStartupInfoW HeapAlloc GetLastError HeapFree SetUnhandledExceptionFilter Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetModuleHandleA LCMapStringA WideCharToMultiByte GetStringTypeA GetLocaleInfoA HeapSize

user32

RegisterClassW ValidateRect GetMenuInfo

gdi32

GetGlyphIndicesA

Sharing

General

Malware Config

Signatures

File Explorer

b66fb905a3acf8487e0a87c3ccd45a96a9e1757bfb80c69ee7c7c27af4710d70

63b33a57f98060b24be7007b3ef02a1a248db8c0adbf0ce9c9016b2c7e2de1cf.exe

kernel32

user32

gdi32

generic