Nursultan[.]exe (2) (infected)[.]7z

General

Target
Nursultan.exe (2) (infected).7z
Size 663.6MB
Sample260125-ldk2qsfx4e
SHA256 3c49b8cec43afebcdf953c5168cdcc3eb7d5ac6afeb69bf4ff2bcf6e730d27be
MD5 b09a9b04245826a38179f892f83ffce3
SHA1 d8e5aa4755a1cc63bab8abb23f04722f5d65848a
SHA512 bf46f92143970014ce515f67fd4321ff08ac74ef3aba27fdd5d35d1b4717f145cbc320f096afd6052f838c141547ed6494f9b79148bddc4e70c6701905051fff
SSDEEP 12582912:DkrDzOjpMljooq+HIyUuuXXzRGOCFLFycCMdMWUlYu98amxicc25Uisp/MzxHkhc:I3vlMoBo1DjRGOepNsR98aSc25U5pkES
TLSH
T11479338B0D6B2C1A697EE719813F41FE70CFEA47A0042D3A3658138552AFA7D5859F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nursultan.exe

File Explorer

Nursultan.exe (2) (infected).7z

.7z 663.6MB
Nursultan.exe

.exe 666.2MB

Nursultan.exe (2) (infected).7z

SHA256 3c49b8cec43afebcdf953c5168cdcc3eb7d5ac6afeb69bf4ff2bcf6e730d27be
MD5 b09a9b04245826a38179f892f83ffce3
SHA1 d8e5aa4755a1cc63bab8abb23f04722f5d65848a
SHA512 bf46f92143970014ce515f67fd4321ff08ac74ef3aba27fdd5d35d1b4717f145cbc320f096afd6052f838c141547ed6494f9b79148bddc4e70c6701905051fff
SSDEEP 12582912:DkrDzOjpMljooq+HIyUuuXXzRGOCFLFycCMdMWUlYu98amxicc25Uisp/MzxHkhc:I3vlMoBo1DjRGOepNsR98aSc25U5pkES
TLSH
T11479338B0D6B2C1A697EE719813F41FE70CFEA47A0042D3A3658138552AFA7D5859F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Nursultan.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 627eb155f3bafa25b0911e49e21532c5de138b95d07f1d28f6e1609263344553
MD5 88d9882d7511e7c24840e1bb9ca68e8e
SHA1 c48210995047a289e3115ac67e04fe7e9c882f23
SHA512 3f9a99605153f3bba71d558f489033f3ba3855aa7d954c5f53aa579d0640f4953931a1523aec764fd51d5d22b509bb6020165cb761f5350aa7671853944ce6f3
SSDEEP 12582912:sdtb+9UWj6wmEgb88WNrOhSDpgRySbWhxkPIy1kYnqx0v7g:4tbGj6w2b88BhwqIy1kIjDg
TLSH
T1B67933D854A0C0E7C44583F5E88AA3F9E22FB54D5DF5CC1B7FC32990E674AA8E852172
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

16753614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Nursultan.exe (2) (infected).7z

Nursultan.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Nursultan.exe (2) (infected).7z

Nursultan.exe

mscoree

dotnet