f1aefbe49a406f12313f1c56deb2e3cd[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
f1aefbe49a406f12313f1c56deb2e3cd.bin
Size 4.1MB
Sample241119-ca3b6symcw
SHA256 8429c6a40fabe75cce8cf01a52879d7e36e992ee52f1220058b4e60eee8991ba
MD5 6bc8f1bb694f5b3ef4e0c3a37656d86e
SHA1 c1eb8adbffe5bb707ac30646dd60a6f4f30d82ef
SHA512 5890ff85a7374d6ceb0170fd4c007937f52362475e989d5849ed5d03e7496c582e92a007119c60f7362418d2d2adc6e5e7a308f022224512fac0d4cbd57a8332
SSDEEP 98304:AP3fGCyrrWf4+XazgYwGP++qVn34bdQpOYQKNOGjf8kd2tFFEr:MGCyfZzEEa34byNrOGtDr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5e8e38f8b153083db2940a4a7e169f3118880ae012c12e87a7a976060d0b1b52.exe

File Explorer

f1aefbe49a406f12313f1c56deb2e3cd.bin

.zip 4.1MB
5e8e38f8b153083db2940a4a7e169f3118880ae012c12e87a7a976060d0b1b52.exe

.exe 4.2MB

f1aefbe49a406f12313f1c56deb2e3cd.bin

SHA256 8429c6a40fabe75cce8cf01a52879d7e36e992ee52f1220058b4e60eee8991ba
MD5 6bc8f1bb694f5b3ef4e0c3a37656d86e
SHA1 c1eb8adbffe5bb707ac30646dd60a6f4f30d82ef
SHA512 5890ff85a7374d6ceb0170fd4c007937f52362475e989d5849ed5d03e7496c582e92a007119c60f7362418d2d2adc6e5e7a308f022224512fac0d4cbd57a8332
SSDEEP 98304:AP3fGCyrrWf4+XazgYwGP++qVn34bdQpOYQKNOGjf8kd2tFFEr:MGCyfZzEEa34byNrOGtDr
MD5 SHA1 SHA512 SSDEEP

Password

infected

5e8e38f8b153083db2940a4a7e169f3118880ae012c12e87a7a976060d0b1b52.exe

IMPHASH 2eabe9054cad5152567f0699947a2c5b
SHA256 5e8e38f8b153083db2940a4a7e169f3118880ae012c12e87a7a976060d0b1b52
MD5 f1aefbe49a406f12313f1c56deb2e3cd
SHA1 182c4978fd940c4d7f504fe985477fe0512cf1f9
SHA512 69e0f083e93b3c0a5ee153e4c6b89cb50bc5bbc4fc9c589606856de518e5705d54219f5e0fda01a6b9d53e03ab76836d335bc3d4a47047590438abd51c36ef78
SSDEEP 98304:4otD52k8suSvvYB9QkFhQ1wl+iuIW9sjOE9hr0bTBB98:4oSkld4bQkF6Cl+Vh09hrkBBC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

12095488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

Size

2.5MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dkllzumy

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

wfvxsvbz

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.taggant

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

f1aefbe49a406f12313f1c56deb2e3cd.bin

5e8e38f8b153083db2940a4a7e169f3118880ae012c12e87a7a976060d0b1b52.exe

kernel32

generic