Nursultan[.]exe (123)[.]7z

General

Target
Nursultan.exe (123).7z
Size 15.9MB
Sample251208-e4rhwa1jfl
SHA256 a722691bd9c2651e1a735f99c85e2b9df02c376eb34ebceddba41c195c28b68b
MD5 8693e7ced2d5bad055ba86cc6d3ad88c
SHA1 41375c9d1280be1f39f7c93a82ef9903b195a649
SHA512 ac13665e98221e15aec6e018b8d3c5580af35cca4d5fef5d7d669fa994508566d357ea77cbc7403dc8c8cf24e12e52baed4cd760568f568578724f79d66b777c
SSDEEP 393216:WbMS7ZVi9udE05o3woUhkF6jMJqeG8fadinLetFQzyk:WIaJP6gUFoMrEmZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nursultan.exe

File Explorer

Nursultan.exe (123).7z

.7z 15.9MB
Nursultan.exe

.exe 16.0MB

Nursultan.exe (123).7z

SHA256 a722691bd9c2651e1a735f99c85e2b9df02c376eb34ebceddba41c195c28b68b
MD5 8693e7ced2d5bad055ba86cc6d3ad88c
SHA1 41375c9d1280be1f39f7c93a82ef9903b195a649
SHA512 ac13665e98221e15aec6e018b8d3c5580af35cca4d5fef5d7d669fa994508566d357ea77cbc7403dc8c8cf24e12e52baed4cd760568f568578724f79d66b777c
SSDEEP 393216:WbMS7ZVi9udE05o3woUhkF6jMJqeG8fadinLetFQzyk:WIaJP6gUFoMrEmZ
MD5 SHA1 SHA512 SSDEEP

Password

123

Nursultan.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 de01f59d93f3999ef9ece06a45cbd7607a54843c9c9bf015d20191d1a638dc22
MD5 a37cc9b94962a99e6fbc445085a17891
SHA1 22c4eb956a6d4e012f344fb468ca0b4e02315e02
SHA512 9b1b2d6ff35efc02d324da0f3eb9b444753931912a2e0012fd60e8a475b211681a5d19d2d2ef4b0d223f2721beb2bc2dda9cd25b62565d2cfceccb7bae333f78
SSDEEP 393216:EjvCS0jVFoxxr+CF3FM1ornZHvwu0caLJe:EWS0pFoxxDFM4np0Je
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

0

Major OS version

4

Entry point

16722030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Nursultan.exe (123).7z

Nursultan.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Nursultan.exe (123).7z

Nursultan.exe

mscoree

dotnet