6c8789f10230012e7bc2cd0a800a1d9b40a4c475

General

Target
6c8789f10230012e7bc2cd0a800a1d9b40a4c475
Size 515KB
Sample241105-lym2tsykds
SHA256 fc3e5b6b9d97afe0e0ad865e5b625c20b2fbf65bef4c46213b9abf941798303d
MD5 303ee2276ac73e659c8930c83d133234
SHA1 6c8789f10230012e7bc2cd0a800a1d9b40a4c475
SHA512 93ca83daf765e80a0b8e53e501a94cfc2b0d0ff892d2a2d0de72e83b38862734dd7e9ba12df9c737617092f61b64d6ef489afedcd7d113b8b3bdd926571ae5f9
SSDEEP 12288:Jg1zMGC9oI7PnlWM6nzC4auzx75m0Tinh3oYDUs:YMnlaBt758nh3PDUs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd

File Explorer

6c8789f10230012e7bc2cd0a800a1d9b40a4c475

.7z 515KB
faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd

.exe 732KB

6c8789f10230012e7bc2cd0a800a1d9b40a4c475

SHA256 fc3e5b6b9d97afe0e0ad865e5b625c20b2fbf65bef4c46213b9abf941798303d
MD5 303ee2276ac73e659c8930c83d133234
SHA1 6c8789f10230012e7bc2cd0a800a1d9b40a4c475
SHA512 93ca83daf765e80a0b8e53e501a94cfc2b0d0ff892d2a2d0de72e83b38862734dd7e9ba12df9c737617092f61b64d6ef489afedcd7d113b8b3bdd926571ae5f9
SSDEEP 12288:Jg1zMGC9oI7PnlWM6nzC4auzx75m0Tinh3oYDUs:YMnlaBt758nh3PDUs
MD5 SHA1 SHA512 SSDEEP

Password

infected

faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd
MD5 659ac9c3f3c0fffb292704cb5e7dd699
SHA1 a3ee2528280cd762c130f680af08583df22bb435
SHA512 0b99ae205eb06e39f0befef1c41776cbddda78e674c639eb51968bba4b70aad45cc7b0dbf4ad9bed12a7a82ac31943185b8f59aab082afb15d9b91924889db10
SSDEEP 12288:fnWjC9X31+oqH0GOzM6/79OBu5hq9ZvbY:fUC1lmvO3/Ih9pY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

280024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.scyle0

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.scyle1

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.scyle2

Size

598KB

Virtual Size

597KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

6c8789f10230012e7bc2cd0a800a1d9b40a4c475

faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

6c8789f10230012e7bc2cd0a800a1d9b40a4c475

faae62d9ef3a65ae1dae20d55b8e787661aaf452ad3b6bdd80ea267d3bd070bd

mscoree

dotnet