6eaeaa684afea0a5772f7afbe5ef165c3a0be6cd2120cd03d35a4d316eb853b8
- SHA256 6eaeaa684afea0a5772f7afbe5ef165c3a0be6cd2120cd03d35a4d316eb853b8
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ef99cf6b2378214934b430a7b9513dfb3fc188fdf212477bf1dc906207663f5.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7ef99cf6b2378214934b430a7b9513dfb3fc188fdf212477bf1dc906207663f5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 6eaeaa684afea0a5772f7afbe5ef165c3a0be6cd2120cd03d35a4d316eb853b8
- Size 248KB
- Sample241106-sec6va1pew
- SHA256 6eaeaa684afea0a5772f7afbe5ef165c3a0be6cd2120cd03d35a4d316eb853b8
- MD5 9936ce213c4cce634049bfda59ae11f4
- SHA1 4e6b01b4f89243fc7829629d870b98e2c7ca053f
- SHA512 c1f4e66f97d9e05a6f55fe23f9dd09c9d232223c8682691d67e0c73ecd87a85e2caa950dc5e10bb72e66631c03c32602abbd2518c0485acffb36d13d32e55d5b
- SSDEEP 6144:l96BdYdm4U/j1F8ADtZwUPlSXwl1BCe6yKf20fMb:73mBF8OtSUsXw776Bf200b
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/7ef99cf6b2378214934b430a7b9513dfb3fc188fdf212477bf1dc906207663f5
File Explorer
-
6eaeaa684afea0a5772f7afbe5ef165c3a0be6cd2120cd03d35a4d316eb853b8.zip 248KB
-
7ef99cf6b2378214934b430a7b9513dfb3fc188fdf212477bf1dc906207663f5.exe 336KB
7ef99cf6b2378214934b430a7b9513dfb3fc188fdf212477bf1dc906207663f5
- IMPHASH fe0b55a75647240d63e8d2d6140a4c09
- SHA256 7ef99cf6b2378214934b430a7b9513dfb3fc188fdf212477bf1dc906207663f5
- MD5 c4f045d7baafb0380485a1e028f1ec48
- SHA1 a07fdb9c8462369f2f721f526e4e18f700029371
- SHA512 2fa9467726c8c11ed218c8d6d644f6377b0d9558e883c30c34dcf83081f532ee02aa720d695947add97499c1395f600e885150ce2d5f23821e2a09eb1b9fd8be
- SSDEEP 6144:tlIkwLjqBJlGO76YKJWF7JmS/UqkxRic+qmDM5EYDu6ZOpsC9:tlI5fqBl6YUW9IENTiEYS6UW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
30431
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\noholi-yulihafamas\67-vogu\momimocivobe\xifeseyicesak24.pdb
kernel32
LoadLibraryA
GetConsoleAliasesW
ReadFile
AddAtomA
CreateFileW
FindActCtxSectionStringA
GetCommProperties
GetSystemWindowsDirectoryW
GlobalHandle
FindFirstVolumeMountPointW
CreateDirectoryExW
LocalSize
GetLogicalDriveStringsA
ReadConsoleInputW
GetComputerNameExA
GetTempPathA
GetCurrentDirectoryA
ContinueDebugEvent
LCMapStringA
GetProcAddress
GlobalAlloc
GetCommandLineW
GetBinaryTypeW
InterlockedExchangeAdd
ReadConsoleOutputCharacterW
CreateMutexW
GetConsoleTitleA
SearchPathA
ExpandEnvironmentStringsW
FindResourceW
FormatMessageA
GetModuleHandleA
EndUpdateResourceA
GetLastError
SetCommMask
GlobalReAlloc
GetConsoleAliasA
TerminateThread
LocalFlags
GetConsoleAliasesLengthW
GetVolumePathNameA
SetVolumeMountPointW
ChangeTimerQueueTimer
GetLocaleInfoW
GetComputerNameA
lstrcpynW
SetConsoleWindowInfo
CopyFileA
DosDateTimeToFileTime
GetSystemWindowsDirectoryA
EnumResourceLanguagesW
LoadModule
GetOverlappedResult
QueryDosDeviceW
CreateActCtxA
DeleteVolumeMountPointW
MoveFileWithProgressW
FoldStringA
WritePrivateProfileStringA
GetUserDefaultLangID
GetConsoleDisplayMode
WaitForSingleObject
GetLongPathNameW
EnumDateFormatsW
InterlockedCompareExchange
EnumTimeFormatsW
VerifyVersionInfoA
FindNextFileW
GetConsoleAliasW
SetLastError
FreeLibrary
CreateFileA
SetStdHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
HeapFree
DeleteFileA
GetStartupInfoW
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
user32
GetMessageTime
msimg32
AlphaBlend
Name
.text
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
188KB
Virtual Size
39.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=150, version=20413,
count=28, id=149, productName=VS2008 build 21022, version=21022,
count=125, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=150, id=1, productName=Unmarked objects,
count=42, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,