e7ab9bade805055ba06243ba8123934608aa7b35e13fc823b8f88bc42c74ebd5
- SHA256 e7ab9bade805055ba06243ba8123934608aa7b35e13fc823b8f88bc42c74ebd5
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77bc9e1c6ed525c2a517635600855407e05a44d1410ef4a26140192a28e476ce.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
77bc9e1c6ed525c2a517635600855407e05a44d1410ef4a26140192a28e476ce.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target e7ab9bade805055ba06243ba8123934608aa7b35e13fc823b8f88bc42c74ebd5
- Size 400KB
- Sample241121-yzpchawpgv
- SHA256 e7ab9bade805055ba06243ba8123934608aa7b35e13fc823b8f88bc42c74ebd5
- MD5 6b3ea5eee8c2ffc1c6f014f0865cfbf1
- SHA1 c5ab9745b98e94c6608f19c37565c7f1cc32a984
- SHA512 f4a71d6e54d1797186ddcddf0156d153f1487463a803f0a3eed333b566d3acf013b9545410dbe49d6d4c358049068b3db7a27a3a2865d17ee33bfe28239a5c3f
- SSDEEP 12288:KAY+B5VzjDhb3WQ8PW+VupG8v+mG2LL5W9slgad:3Y+BHxbh+V/mGsL5eQn
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/77bc9e1c6ed525c2a517635600855407e05a44d1410ef4a26140192a28e476ce
File Explorer
-
e7ab9bade805055ba06243ba8123934608aa7b35e13fc823b8f88bc42c74ebd5.zip 400KB
-
77bc9e1c6ed525c2a517635600855407e05a44d1410ef4a26140192a28e476ce.exe 858KB
77bc9e1c6ed525c2a517635600855407e05a44d1410ef4a26140192a28e476ce
- IMPHASH 49be0836dac021f86af2cb207b4613c8
- SHA256 77bc9e1c6ed525c2a517635600855407e05a44d1410ef4a26140192a28e476ce
- MD5 5e1aa7db6c4525d63939bd5731e4f335
- SHA1 a02b9a3ba506f11e40cbc481b13a9adfcd385bae
- SHA512 bfbf9b236b80c0e19b3492c40566093d08d4106c03f571748d7fc19287db3d1cd336d5c1cd2f292499bb4af0b5434d121906cfaf7a189cc98813fee3b9afa327
- SSDEEP 6144:s1W1nA/DpvTpJMDqoskW9hzudastfAOvCjYxfdlGLJDPwBKxs0gyIBqnXbV8MUcN:s1Wl8TpJMxskWv6tf4wBKxs0YqLV6c8Q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
134730
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
OutputDebugStringW
FormatMessageW
VirtualProtect
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetProcessHeap
WriteFile
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GetStdHandle
LoadLibraryExW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetCPInfo
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
GetLastError
FreeLibrary
CreateFileW
user32
GrayStringA
GetDC
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
ShowWindow
SetCapture
ReleaseCapture
LoadImageW
LoadCursorW
SetWindowLongW
GetWindowLongW
AdjustWindowRect
UpdateWindow
d3d11
D3D11CreateDeviceAndSwapChain
gdiplus
GdiplusStartup
GdiplusShutdown
Name
.text
Size
210KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
258KB
Virtual Size
258KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
165KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=20, id=259, version=27412,
count=160, id=261, version=27412,
count=26, id=260, version=27412,
count=20, id=259, version=24123,
count=59, id=261, version=24123,
count=34, id=260, version=24123,
count=9, id=257, version=27412,
count=129, id=1, productName=Unmarked objects,
count=9, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,