Babuk Builder.7z
- SHA256 bced4dc174d5858aa2061ec497d2fbdbb6a705186b2011a146536021c500bed6
Password
infected
Overview
overview
10Static
static
3builder.exe
windows10-2004-x64
9builder.exe
windows11-21h2-x64
3d_esxi.out
ubuntu-18.04-amd64
1d_nas_arm.out
debian-12-armhf
3d_nas_x86.out
ubuntu-18.04-amd64
3d_win.exe
windows10-2004-x64
7d_win.exe
windows11-21h2-x64
7e_esxi.out
ubuntu-18.04-amd64
1e_nas_arm.out
debian-12-armhf
3e_nas_x86.out
ubuntu-18.04-amd64
3e_win.exe
windows10-2004-x64
10e_win.exe
windows11-21h2-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
builder.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
23 signatures
900 seconds
Behavioral task
behavioral2
Sample
builder.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral3
Sample
d_esxi.out
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
d_nas_arm.out
Resource
debian12-armhf-20260127-en
debian-12-armhf
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
d_nas_x86.out
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
1 signatures
900 seconds
Behavioral task
behavioral6
Sample
d_win.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral7
Sample
d_win.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral8
Sample
e_esxi.out
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
e_nas_arm.out
Resource
debian12-armhf-20260127-en
debian-12-armhf
1 signatures
900 seconds
Behavioral task
behavioral10
Sample
e_nas_x86.out
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
1 signatures
900 seconds
Behavioral task
behavioral11
Sample
e_win.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
900 seconds
Behavioral task
behavioral12
Sample
e_win.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
900 seconds
General
- Target Babuk Builder.7z
- Size 4.8MB
- Sample260407-kfgawses7y
- SHA256 bced4dc174d5858aa2061ec497d2fbdbb6a705186b2011a146536021c500bed6
- MD5 c39da89f2510a5bd2c683b4b2b858ee4
- SHA1 65759925514e2a68f4b9255338fa4dcd74aeb8dc
- SHA512 e6d0355f03f490d016e33e231797cf9b3a3744d2ec98ac66368a996fda2c09853f954c2cd392267da72a1582bf224f48a0233b0a72ac5646db3134b4ac7cfae4
- SSDEEP 98304:gHHcBFCm1iA1kScvBzSbq55B0dXXW8fZazyDwCOBREZy3boJLVsYfC:DUNS+5juXGc4+Dw3BREZq4/fC
- TLSH T1B236333558FE11D63C28D44B713026EA6B1B4CEFCDFB3261E0AEA1D92BDE825DAD4444
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/builder.exe unpack002/d_win.bin unpack002/e_win.bin
File Explorer
-
Babuk Builder.7z.7z 4.8MB
-
BuilderBabuk.zip.zip 4.8MB
-
__MACOSX/._builder.exe174B
-
__MACOSX/._d_esxi.out174B
-
__MACOSX/._d_nas_arm.out174B
-
__MACOSX/._d_nas_x86.out174B
-
__MACOSX/._d_win.bin174B
-
__MACOSX/._e_esxi.out174B
-
__MACOSX/._e_nas_arm.out174B
-
__MACOSX/._e_nas_x86.out174B
-
__MACOSX/._e_win.bin374B
-
__MACOSX/._note.txt484B
-
builder.exe.exe 121KB
-
d_esxi.out.elf 53KB
-
d_nas_arm.out.elf 2.0MB
-
d_nas_x86.out.elf 1.9MB
-
d_win.bin.exe 68KB
-
e_esxi.out.elf 69KB
-
e_nas_arm.out.elf 2.1MB
-
e_nas_x86.out.elf 2.0MB
-
e_win.bin.exe 79KB
-
note.txt4B
BuilderBabuk.zip
- SHA256 82e560a078cd7bb4472d5af832a04c4bc8f1001bac97b1574efe9863d3f66550
- MD5 aee27a5ebedadf12beed294f59026162
- SHA1 fa5153b6011c578ce85c8c6d2a431ee9b8be03ec
- SHA512 74548443d979e4b07904ca6232df1d787fa7481bfb52dfdd0331882cb407ba73c0548ef8544c02ed2cb2d11401ae86c546875db4408127d30b862cb383da921a
- SSDEEP 98304:a7TUPOmgWEeBcQVltn58PsCYBy7PJUhfTJ2RMOMA8vNFDf8NCE3njOSLQJ0TsYnY:rFgaBcKltnOE7MPJUhLCMhN8NnjBEJYY
- TLSH T1593633F40C7A1BD6345522FA8C55EE8CC1AF798BB00D66B8F703AA5C7D88509CD72276
- MD5 SHA1 SHA512 SSDEEP TLSH
__MACOSX/._builder.exe
- SHA256 606b224b431801d92a87b9afc9e35dad8b1743f46f8dc44d2f0460cf14f8b44b
- MD5 22f6d2fe4f85b2be085105bab2bbe691
- SHA1 0aca19537c036165a46e458d6c9b09e98f06875b
- SHA512 0cce9c665702a38a72f2ab6d7932c655c742edfb9a84e07d881907da7381aefdadcf264cb10f93299c7d140f54ec2d0629723eb71e71d25b59d98e3ebead9d5d
- TLSH T18FC012E63E840250C441DB308DF334D0EBFF4231D9877522751D40000700514B57034B
- MD5 SHA1 SHA512 TLSH
__MACOSX/._d_esxi.out
- SHA256 606b224b431801d92a87b9afc9e35dad8b1743f46f8dc44d2f0460cf14f8b44b
- MD5 22f6d2fe4f85b2be085105bab2bbe691
- SHA1 0aca19537c036165a46e458d6c9b09e98f06875b
- SHA512 0cce9c665702a38a72f2ab6d7932c655c742edfb9a84e07d881907da7381aefdadcf264cb10f93299c7d140f54ec2d0629723eb71e71d25b59d98e3ebead9d5d
- TLSH T18FC012E63E840250C441DB308DF334D0EBFF4231D9877522751D40000700514B57034B
- MD5 SHA1 SHA512 TLSH
__MACOSX/._d_nas_arm.out
- SHA256 606b224b431801d92a87b9afc9e35dad8b1743f46f8dc44d2f0460cf14f8b44b
- MD5 22f6d2fe4f85b2be085105bab2bbe691
- SHA1 0aca19537c036165a46e458d6c9b09e98f06875b
- SHA512 0cce9c665702a38a72f2ab6d7932c655c742edfb9a84e07d881907da7381aefdadcf264cb10f93299c7d140f54ec2d0629723eb71e71d25b59d98e3ebead9d5d
- TLSH T18FC012E63E840250C441DB308DF334D0EBFF4231D9877522751D40000700514B57034B
- MD5 SHA1 SHA512 TLSH
__MACOSX/._d_nas_x86.out
- SHA256 606b224b431801d92a87b9afc9e35dad8b1743f46f8dc44d2f0460cf14f8b44b
- MD5 22f6d2fe4f85b2be085105bab2bbe691
- SHA1 0aca19537c036165a46e458d6c9b09e98f06875b
- SHA512 0cce9c665702a38a72f2ab6d7932c655c742edfb9a84e07d881907da7381aefdadcf264cb10f93299c7d140f54ec2d0629723eb71e71d25b59d98e3ebead9d5d
- TLSH T18FC012E63E840250C441DB308DF334D0EBFF4231D9877522751D40000700514B57034B
- MD5 SHA1 SHA512 TLSH
__MACOSX/._d_win.bin
- SHA256 606b224b431801d92a87b9afc9e35dad8b1743f46f8dc44d2f0460cf14f8b44b
- MD5 22f6d2fe4f85b2be085105bab2bbe691
- SHA1 0aca19537c036165a46e458d6c9b09e98f06875b
- SHA512 0cce9c665702a38a72f2ab6d7932c655c742edfb9a84e07d881907da7381aefdadcf264cb10f93299c7d140f54ec2d0629723eb71e71d25b59d98e3ebead9d5d
- TLSH T18FC012E63E840250C441DB308DF334D0EBFF4231D9877522751D40000700514B57034B
- MD5 SHA1 SHA512 TLSH
__MACOSX/._e_esxi.out
- SHA256 606b224b431801d92a87b9afc9e35dad8b1743f46f8dc44d2f0460cf14f8b44b
- MD5 22f6d2fe4f85b2be085105bab2bbe691
- SHA1 0aca19537c036165a46e458d6c9b09e98f06875b
- SHA512 0cce9c665702a38a72f2ab6d7932c655c742edfb9a84e07d881907da7381aefdadcf264cb10f93299c7d140f54ec2d0629723eb71e71d25b59d98e3ebead9d5d
- TLSH T18FC012E63E840250C441DB308DF334D0EBFF4231D9877522751D40000700514B57034B
- MD5 SHA1 SHA512 TLSH
__MACOSX/._e_nas_arm.out
- SHA256 606b224b431801d92a87b9afc9e35dad8b1743f46f8dc44d2f0460cf14f8b44b
- MD5 22f6d2fe4f85b2be085105bab2bbe691
- SHA1 0aca19537c036165a46e458d6c9b09e98f06875b
- SHA512 0cce9c665702a38a72f2ab6d7932c655c742edfb9a84e07d881907da7381aefdadcf264cb10f93299c7d140f54ec2d0629723eb71e71d25b59d98e3ebead9d5d
- TLSH T18FC012E63E840250C441DB308DF334D0EBFF4231D9877522751D40000700514B57034B
- MD5 SHA1 SHA512 TLSH
__MACOSX/._e_nas_x86.out
- SHA256 606b224b431801d92a87b9afc9e35dad8b1743f46f8dc44d2f0460cf14f8b44b
- MD5 22f6d2fe4f85b2be085105bab2bbe691
- SHA1 0aca19537c036165a46e458d6c9b09e98f06875b
- SHA512 0cce9c665702a38a72f2ab6d7932c655c742edfb9a84e07d881907da7381aefdadcf264cb10f93299c7d140f54ec2d0629723eb71e71d25b59d98e3ebead9d5d
- TLSH T18FC012E63E840250C441DB308DF334D0EBFF4231D9877522751D40000700514B57034B
- MD5 SHA1 SHA512 TLSH
__MACOSX/._e_win.bin
- SHA256 13d1fcc3aafc70299397f8aece0d2ef3b04d4246cbce801a72d9e6ccc3427a8d
- MD5 f5cf15f06447359c6892b630fb331e01
- SHA1 e44e046dacb2ed0508beef3020512ab017516d73
- SHA512 ad86e9212c364feb963938347617718ecc8f07e4af9282bb90d1506d9dec8f453d8bd7244f98ca6ca3eca00eac9b222fc12c4c2f58d04d20165a532b3142313f
- TLSH T15FE0C2F70B8845A5D956D3B41DFABB6A66AA8015C8C30713BC5EC6400F142D0BA7498F
- MD5 SHA1 SHA512 TLSH
__MACOSX/._note.txt
- SHA256 f2fdfe2ad0b1289ed3a351965ba2491597d0df53a3396453339cdcbeb9b5e3dd
- MD5 7b6f6e2cb28bbd7a6097ac48aec9e373
- SHA1 239319c2aec562be2923279a7586ad77b1ac15f4
- SHA512 a285407a128bbf73f0dbca60501c20e285bad09dda35e2f953fed7bf73899f237f71aed6ccbec2503fbc1929aa254c07b23894954c3abd877adcbf8d16dc8ba9
- TLSH T1EAF0D8AC9F819941C98881B4514DA71413B8A9BD87D5DE17738CCD922B24D102AB57FC
- MD5 SHA1 SHA512 TLSH
builder.exe
- IMPHASH d3b5af96763bcd3d7a96fdb6495c42f3
- SHA256 4fa565cc2ebfe97b996786facdb454e4328a28792e27e80e8b46fe24b44781af
- MD5 5dfa998f62612e10d5d28d26948dd50f
- SHA1 05618b47ccf5aba595fba60feb30969b5500abb3
- SHA512 83a0f6b9b43d88ea704f0d006937e020a2dd7c207bc84937d2ca6d80f808b0b583a555082eb529c902f2194cb872a23d5666302908f3ed0418f061e50c56defa
- SSDEEP 3072:FGLXPggYI4tRE/UAhW9SOsRHor5bHVZ3D1Lowg0p53NTz0cKzWZH28wjJ5Pq+ZoR:F2XIgYxZxPT53NjK2H6PSDlu9sYtC0gF
- TLSH T1CAC37C8172C0D472E97619720A60DAF09E3DFC301A50AEEB778416394E61AD3DA25F7F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
20435
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateFileA
lstrcpyA
CloseHandle
lstrcatA
ExitProcess
CreateDirectoryA
WriteConsoleW
WriteFile
GetFileSize
ReadFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CreateFileW
DecodePointer
advapi32
CryptGenRandom
CryptAcquireContextW
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26715,
count=148, id=261, version=26715,
count=18, id=260, version=26715,
count=37, id=261, version=28920,
count=18, id=260, version=28920,
count=17, id=259, version=28920,
count=5, id=257, version=26715,
count=91, id=1, productName=Unmarked objects,
count=2, id=265, version=29111,
count=1, id=255, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=258, productName=VS2019 v16.7.1 build 29111, version=29111,
d_esxi.out
- SHA256 930760c00de1b9a4bc2eefcd96173f1e9a906b11a9566c517fcb87a13acaa327
- MD5 64b8e75e76283e034e134c128e9a405a
- SHA1 cd19c2741261de97e91943148ba8c0863567b461
- SHA512 8e9e0ceafc88504a408ed9a91514675b7e13e3f4ed5f3a2c0208f441c55d783e3708427fc49489bdd9f74804a00a093c6e28c5a012d483b502bee09995f6a84d
- SSDEEP 1536:2sIH3ny6iOyCNx3SBqzMhpScQLBrdE2T2wETjSeQPH:2LXy6WCNiPYcQLBrjTkTPw
- TLSH T19B33707F8B69128FE183B075D9C762F3E12412B85755908FA384293E6E398E397D8317
- MD5 SHA1 SHA512 SSDEEP TLSH
d_nas_arm.out
- SHA256 2cd6d4a52dbaf9e79d93492ad73dc229e06d0cee9e3327cc3bef165fae06f918
- MD5 7de2173c75f9778b9c9c20447ad4c1f8
- SHA1 0bea740c49e30d3c8d58976951331068f181c453
- SHA512 666387bea53b85ccb8d6f5925f2c4fa69530836a58834234f6c9c5c0034997dad2270f270bea138796f7bb2010bcf2c4430bbaf10fa8a6f50b52323b84b21e18
- SSDEEP 24576:T138npoIXekt5RAg6hjRofWxTRLgHykaWm/kC4szj05oFVps5RThELC7ox0Yulo7:TNWdJxNxuGWsRlW011vfH6/E6tRb
- TLSH T1D5A57D4B7CD1894BC4E426B7ACBE82C433665ABD6786231B5D05FE393EBE1990E35700
- MD5 SHA1 SHA512 SSDEEP TLSH
d_nas_x86.out
- SHA256 51fe57795105eb1e618d35bd99fcc096ee3687455cd4e330396c0d701bc3a6a1
- MD5 29efe5693da727cdca8c637d343b07cd
- SHA1 a5ee4e8a413ea03639721f31de5f42d4b0968039
- SHA512 5f19057919b4018114fcb58e0d848960acbf26d461077a85a935b64e7ec161f45047e6dc6c4664058b36902bc39b297c292eb8af2557dddd5bbdfdc975e6f377
- SSDEEP 49152:Emsq5TJqKK8XhjTyUCWU1pWmUYkfhtpmXNb:EmswTJqURIUtfhtoB
- TLSH T1BF957D41FDC750F6D1471A3158A7A2AF2731A9098B30EBC3DA547E6AFD3B6D50832329
- MD5 SHA1 SHA512 SSDEEP TLSH
d_win.bin
- IMPHASH 8ea7bca7b3cebabb79daebcc58679319
- SHA256 eb22f22fedb24ef3d06d2ba6ac9bc53528f8d1e489fefeac9501b926a0be6097
- MD5 ca8dcb4c02f5b3b09b0bc49452f05bd6
- SHA1 0e0001da7e198da8e3e82252d5414dbcb8bee9d1
- SHA512 9221c98a0ad3179725fd66de3fcfbc0f97af300431d82645ee0b9d8e16a756b7881a91f661a569156bf0d5984e54703d513d753329bffd382327cc7a194ffc48
- SSDEEP 1536:yHjUeTD0DsbEmDx1xhiBsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2hyqM8EQ:yDUeTD0gbrDx1xusrQLOJgY8Zp8LHD4D
- TLSH T1726383116B45E6B6D5912130811BF1B6C23A197003F26267A7C11BBBFB256B8F27DF23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
29936
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCommandLineW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
GetFileSizeEx
GetLogicalDrives
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
CloseHandle
CreateMutexA
WaitForMultipleObjects
ExitProcess
CreateThread
ExitThread
SetProcessShutdownParameters
GetSystemInfo
lstrcmpW
lstrcmpiW
lstrcpyW
lstrcatW
lstrlenW
OpenMutexA
MoveFileExW
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
WaitForSingleObject
CreateSemaphoreA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
user32
MessageBoxA
MessageBoxW
shell32
SHEmptyRecycleBinA
CommandLineToArgvW
netapi32
NetShareEnum
NetApiBufferFree
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
WNetGetConnectionW
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=260, version=28920,
count=6, id=259, version=28920,
count=11, id=257, version=26715,
count=52, id=1, productName=Unmarked objects,
count=8, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=258, productName=VS2019 v16.7.1 build 29111, version=29111,
e_esxi.out
- SHA256 dc90560d7198bf824b65ba2cfbe403d84d38113f41a1aa2f37f8d827fd9e0ceb
- MD5 ce73b00417464190d7fb9b36af74968a
- SHA1 885a734c7869b52aa125674cb430199b2645cda0
- SHA512 7710eb3c601f0b6066606f7a098811efa8e411b12164e7bcb2ab289920156367ee53e6c243937d89ccf17af9c207856fbd2f125982e5242938cd189965a3556d
- SSDEEP 1536:OgsIH3ny6nOyCNTs0BMScQLBrdE2TUwELzzhZaBHU2eQP:OgLXy6pCNLpcQLBrjTqloOw
- TLSH T10363A27F9B29119FE143B074D9C762F3E52012F45354A48BA344292E6EF98E25BCB317
- MD5 SHA1 SHA512 SSDEEP TLSH
e_nas_arm.out
- SHA256 e8cee8eab4020e1aadd4631ed626ab54d8733f8b14d683ca943cd4e124eeef55
- MD5 28249fc247a858d9727c860e4a484392
- SHA1 37b2ee4c3f6b9976e2335421a05e4b480c09ff9d
- SHA512 af4109064b524761fc3b0b5b27ab634e9eda7c8897fe5fb5b2d39dd1b620a402eb97ce5e76d99f9a959c2c6a162a2037c398c2181d2f66d029b46d73ec7f43e4
- SSDEEP 49152:RJZuecSwpeH2LTBnW01NEXTY4TumnwM7UB3:nZueanLjSumnJ70
- TLSH T1BDA55B47BC91854AC4E82677ECBE81C433625AFD578A621A5D05FE393EFE2890E37704
- MD5 SHA1 SHA512 SSDEEP TLSH
e_nas_x86.out
- SHA256 e505b24de50b14aed35cf40725dc0185cab06fed90269d445ec7a4b36de124b6
- MD5 1453c8123be53bf4458b1a8e7e54ddbb
- SHA1 a1064f1393e4d548c27f1a4b5fb1a5cf9f5267e7
- SHA512 2eeffbcf1b8161f3f61a5654213004212042ca95b87393052a54b0a28416ee82eef113891488cc272581d6c2a557b1283712f8658ad48c219823b204724bc150
- SSDEEP 49152:Tx8AK8iCuL2j/WU1jMEYaCQ4esXSdq8J3:t87Rc5CQ4eXdqS
- TLSH T165A57C01FCD640B6D5461A71C8BBA2AF2330A9894724EBC3DA447E69FDFB5D64C33219
- MD5 SHA1 SHA512 SSDEEP TLSH
e_win.bin
- IMPHASH 202fa14f574c71c2f95878e40a79322d
- SHA256 ea95f131bd9b49104d9e7ae83335254549ded9d71d557c6e4746740aecca2c85
- MD5 e5adc80639046a5c69bcfeee458e0833
- SHA1 d9e3f9edda5df290b5be6fb1d335b750dd7c6758
- SHA512 c11a24e14ba5fa2b0e2c2b544dd4218ce4c8caae3db7cebd5b0305223f96bde09c9bd237cb8d32768f30118f7be73240971e772f7a89db7c0fba5c6105107e3a
- SSDEEP 1536:H6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:7hZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
- TLSH T17C83B7115945D2B6C5D12231C157F1AAC13A19F003B5A78B63C027AEFBD0AA8F66FF27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
43968
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
OpenProcess
GetTickCount
GetModuleHandleA
GetProcAddress
LoadLibraryA
lstrcmpW
lstrlenW
SetVolumeMountPointW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrlenA
GetCommandLineW
FindClose
FindFirstFileW
FindNextFileW
GetFileSizeEx
GetCurrentProcess
ReadFile
SetFileAttributesW
SetFilePointerEx
WaitForSingleObject
CreateMutexA
WaitForMultipleObjects
GetCurrentProcessId
ExitProcess
CreateThread
ExitThread
SetProcessShutdownParameters
GetSystemInfo
lstrcmpiW
lstrcpyW
lstrcatW
OpenMutexA
MoveFileExW
WideCharToMultiByte
HeapAlloc
HeapFree
GetProcessHeap
ReleaseSemaphore
CreateSemaphoreA
TerminateProcess
Sleep
GetLastError
CloseHandle
GetVolumePathNamesForVolumeNameW
GetDriveTypeW
FindVolumeClose
FindNextVolumeW
GetLogicalDrives
FindFirstVolumeW
user32
wsprintfA
advapi32
QueryServiceStatusEx
OpenSCManagerA
EnumDependentServicesA
ControlService
CloseServiceHandle
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
OpenServiceA
shell32
SHEmptyRecycleBinA
CommandLineToArgvW
ShellExecuteW
netapi32
NetShareEnum
NetApiBufferFree
rstrtmgr
RmGetList
RmStartSession
RmEndSession
RmRegisterResources
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
WNetGetConnectionW
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
616B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.CRT
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=28920,
count=15, id=257, version=26715,
count=80, id=1, productName=Unmarked objects,
count=10, id=261, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=258, productName=VS2019 v16.7.1 build 29111, version=29111,
note.txt
- SHA256 982d9e3eb996f559e633f4d194def3761d909f5a3b647d1a851fead67c32c9d1
- MD5 1cb251ec0d568de6a929b520c4aed8d1
- SHA1 372ea08cab33e71c02c651dbc83a474d32c676ea
- SHA512 eaf2c12742cb8c161bcbd84b032b9bb98999a23282542672ca01cc6edd268f7dce9987ad6b2bc79305634f89d90b90102bcd59a57e7135b8e3ceb93c0597117b
- MD5 SHA1 SHA512