bsast_22777638550.zip
- SHA256 fb4707fbd3096d5370f5fcc5d029b76ba9607f7c20dc1a320fd82ab6a109ee57
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6.exe
Resource
win11-20250619-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target bsast_22777638550.zip
- Size 70KB
- Sample250623-ehn6maxlt2
- SHA256 fb4707fbd3096d5370f5fcc5d029b76ba9607f7c20dc1a320fd82ab6a109ee57
- MD5 bd819344d4352a9f8bc10745ab167235
- SHA1 84875656ab8827022848b35cb73dc44dfed17999
- SHA512 489cf52e1ef8ec122140c2207eba32a04f2f1c92833dc59e5279b22a7fac20ef0cf468bafa5d2332410ac2d7019f80244f7e6a7ee9b96f76c3edea162b6a223e
- SSDEEP 1536:R6lmfoWQkfEgD4cfETyw3/IDLc9OlX35tpEh8pZroN4i:imEkVk/H/IDJV3TpEhYZrm4i
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6
File Explorer
-
bsast_22777638550.zip.zip 70KB
-
4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6.exe 103KB
4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6
- IMPHASH 386f8e2800724b15817140cb37057ca1
- SHA256 4ab0ae29c6ed5a3f2e0319992de812fc65be4048739c7f10c6f729fe4238abf6
- MD5 be10edf2ad5e39d23e0e8e1b19029aa0
- SHA1 7d1764af5505590951cd0c8131fe2da01776f554
- SHA512 1de75339fcf6bc9bd59dff4d5327144e3436740e0aa14ba344e5dd4e73001a8481123d5437f7b9859505d1a4fe6b7927e4268db94c93826d9ed1c2a8108b6726
- SSDEEP 1536:6GB8VNKK1k4Xtl086CyUN972Cf2wR2wcLRb6kogpRKPcC0006CA7qS/a3:LBMtkYt6ZCRNvuwkRb5EPfzZCwa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
25322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitThread
PostQueuedCompletionStatus
GlobalAlloc
GlobalFree
CreateThread
GetComputerNameW
CreateIoCompletionPort
CreateTimerQueue
GetCurrentProcess
LocalFree
FindFirstFileW
FindNextFileW
InterlockedDecrement
FindClose
GetSystemInfo
InterlockedIncrement
GetCommandLineW
CreateDirectoryW
DeleteFileW
CreateProcessW
CopyFileW
GetVersionExW
GetProcessId
GetQueuedCompletionStatus
LoadLibraryA
Module32FirstW
GetProcAddress
FreeLibrary
FindFirstVolumeW
GetSystemDefaultUILanguage
TerminateProcess
SetFilePointer
GetLocaleInfoW
OpenProcess
GetLogicalDriveStringsW
Process32NextW
Process32FirstW
DeleteTimerQueue
SetVolumeMountPointW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
GetTickCount
GetDriveTypeW
GetModuleHandleW
HeapFree
HeapAlloc
LeaveCriticalSection
Sleep
WaitForSingleObject
CreateMutexA
lstrlenW
MoveFileW
lstrcpyW
WideCharToMultiByte
ExitProcess
DeleteCriticalSection
SetFilePointerEx
CloseHandle
lstrcatW
GetLastError
SetFileAttributesW
GetFileAttributesW
CreateFileW
lstrlenA
GetEnvironmentVariableW
InitializeCriticalSection
GetModuleFileNameW
WriteFile
GetFileSizeEx
ReadFile
lstrcmpW
lstrcmpiW
MultiByteToWideChar
EnterCriticalSection
CancelIo
CreateTimerQueueTimer
GetNativeSystemInfo
GetProcessHeap
CreateToolhelp32Snapshot
user32
SetTimer
CreateMenu
PostQuitMessage
KillTimer
AppendMenuW
SetMenu
MoveWindow
UpdateWindow
CreatePopupMenu
SendMessageW
MessageBoxW
IsWindowVisible
DestroyWindow
GetWindowRect
CreateWindowExW
PostMessageW
GetKeyState
UnregisterHotKey
DefWindowProcW
RegisterHotKey
TranslateMessage
DispatchMessageW
GetMessageW
MessageBoxA
PeekMessageW
UnregisterClassW
EnableWindow
ShowWindow
wvsprintfW
RegisterClassW
gdi32
DeleteObject
CreateFontW
comdlg32
GetOpenFileNameW
advapi32
LookupAccountNameW
GetUserNameW
BuildTrusteeWithSidW
InitializeSecurityDescriptor
OpenProcessToken
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
SetSecurityDescriptorOwner
AdjustTokenPrivileges
SetSecurityDescriptorDacl
LookupPrivilegeValueW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegSetValueExW
RegCloseKey
RegCreateKeyA
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
QueryServiceStatusEx
OpenServiceW
EnumDependentServicesW
ControlService
OpenSCManagerW
CloseServiceHandle
shell32
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
DragAcceptFiles
SHGetMalloc
DragQueryFileW
SHGetSpecialFolderPathW
SHEmptyRecycleBinW
CommandLineToArgvW
ole32
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoTaskMemFree
CoUninitialize
CoCreateInstance
oleaut32
VariantInit
VariantClear
shlwapi
StrStrIA
StrCmpNW
StrStrIW
StrToIntW
StrStrA
iphlpapi
GetIpNetTable
netapi32
NetApiBufferFree
NetShareEnum
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
ws2_32
WSAGetLastError
setsockopt
freeaddrinfo
htons
getsockopt
gethostname
inet_ntoa
WSAAddressToStringW
socket
WSAStartup
getaddrinfo
WSASocketW
shutdown
gethostbyname
closesocket
WSAIoctl
bind
WSACleanup
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetOpenUrlW
comctl32
ord17
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=259, version=30034,
count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=207, id=1, productName=Unmarked objects,
count=22, id=265, version=30133,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,