General

  • Target

    XmS.rar

  • Size

    18.7MB

  • MD5

    28dc30f2e79db47b9ac7c978b5e2b90f

  • SHA1

    850f29689f9afe170e204e24b5bc9caa517d4efd

  • SHA256

    c09fc91505605c78df87ecfb27233d9f34acca79dc3555683755cabe65f497e5

  • SHA512

    00a3ac46a48af625b0e4c9f41e1f24068059168802eb7c86ec90c8276d53083d20ef132e568150640c6f3f8b130d213659e5f10b3dcc64435969a032e3a2dcb0

  • SSDEEP

    393216:rjXHYBQorHnPWC7KXkXNxn954tzE4LiZn4ow6XSiB0h7rhr/KD9oqUsKW:rDH3YH7OENx9549E4LiZn4ow6XzBknhS

Score
10/10

Malware Config

Signatures

  • Babbleloader family
  • Detects BabbleLoader Payload 1 IoCs
  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • XmS.rar
    .rar

    Password: 2024

  • 0FC343C0.dll
    .dll windows:10 windows x64 arch:x64

    Password: 2024

    482ab440211976ea17ec54e3ce97e53d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • B7091C83.dll
    .dll windows:5 windows x86 arch:x86

    Password: 2024

    d811d71710ad58776155b7a8da1fa9db


    Code Sign

    Headers

    Imports

    Sections

  • CbsMsg.dll
    .dll windows:10 windows x64 arch:x64

    Password: 2024

    3a6fd3b46b76f3ce7178b2e11f50b05a


    Code Sign

    Headers

    Imports

    Sections

  • DICTS/mshwchtrIME.dll
    .dll windows:10 windows x64 arch:x64

    Password: 2024


    Headers

    Sections

  • PresentationCore/PresentationCore.dll
    .dll windows:6 windows x86 arch:x86

    Password: 2024

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • PresentationCore/System.Data.dll
    .dll windows:6 windows x86 arch:x86

    Password: 2024

    025065f1f653f3ecea3431275b0ac9ea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • RUN.exe
    .exe windows:6 windows x64 arch:x64

    Password: 2024

    ae18b2b09a857feb4b3390408f106da3


    Headers

    Imports

    Sections

  • mscorlib/SettingsHandlers_InputPersonalization.dll
    .dll windows:10 windows x64 arch:x64

    Password: 2024

    b1ed2f734ce31b7a7587324d68b842c5


    Headers

    Imports

    Exports

    Sections

  • mscorlib/SettingsHandlers_ManagePhone.dll
    .dll windows:10 windows x64 arch:x64

    d0cb94157f279cdb57d7e3c1d820c74a


    Headers

    Imports

    Exports

    Sections

  • mscorlib/SettingsHandlers_WorkAccess.dll
    .dll windows:10 windows x64 arch:x64

    f0058412f3431590bb1827e4300affd4


    Headers

    Imports

    Exports

    Sections

  • mscorlib/SettingsHandlers_nt.dll
    .dll windows:10 windows x64 arch:x64

    7ae06e70115094afbbb6316378531a7e


    Headers

    Imports

    Exports

    Sections

  • mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normidna.nlp
  • mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfc.nlp
  • mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfd.nlp
  • mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfkc.nlp
  • mscorlib/v4.0_4.0.0.0__b77a5c561934e089/normnfkd.nlp
  • mshwkorrIME.dll
    .dll windows:10 windows x64 arch:x64


    Headers

    Sections

  • twain_32.dll
    .dll windows:10 windows x86 arch:x86

    316cd668ed705c998eae8d3bd7bd168f


    Headers

    Imports

    Exports

    Sections

  • wrpintapi.dll
    .dll windows:10 windows x64 arch:x64

    88d112d340f48a8e711dbb236eff1b92


    Headers

    Imports

    Exports

    Sections