matiex[.]zip | Triage™

General

Target
matiex.zip
Size 472KB
Sample260427-e31edsew5k
SHA256 84fee1e1bbd2269553ce335265d9c2ee25be3e2fbe064399d6a24ae74fcce605
MD5 d2a7e57426949fe4242df26908719037
SHA1 3106ded05e7b8973fc592312f153a17e954e4b14
SHA512 f8386cf5079e0e9c14901b657b9a59629e2c17dd165c0a0584a2a21471a127be47cad01f7661639f41669534f3d92d053e8e1378dd481f9a26c5191bb98b2fa9
SSDEEP 6144:xAKoNIP/D7j7p7clMxYryItTujbroz/wlKAo6fndiR3vaJlqBZTXfxzxKKJz6+9V:xAKoauMeWItThTA1iR/GlqBZzZzxJ670
TLSH
T18EA423C6A66587F2E2663199C17B12EEE2FD341CA309B10CDB23675D5011E6C768FC8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118

File Explorer

matiex.zip

.zip 472KB
0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118

.exe 715KB

matiex.zip

SHA256 84fee1e1bbd2269553ce335265d9c2ee25be3e2fbe064399d6a24ae74fcce605
MD5 d2a7e57426949fe4242df26908719037
SHA1 3106ded05e7b8973fc592312f153a17e954e4b14
SHA512 f8386cf5079e0e9c14901b657b9a59629e2c17dd165c0a0584a2a21471a127be47cad01f7661639f41669534f3d92d053e8e1378dd481f9a26c5191bb98b2fa9
SSDEEP 6144:xAKoNIP/D7j7p7clMxYryItTujbroz/wlKAo6fndiR3vaJlqBZTXfxzxKKJz6+9V:xAKoauMeWItThTA1iR/GlqBZzZzxJ670
TLSH
T18EA423C6A66587F2E2663199C17B12EEE2FD341CA309B10CDB23675D5011E6C768FC8B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0ed96cf4589be7b6b9b9562a165f4587ecf61e70a4958fb524f75c8b7c0b3fc9
MD5 0b52424adb115b1336d084cf0cfbb73e
SHA1 084e85f67c1743bc12a6bdea960a3fd34025cf51
SHA512 4e162fdb73d382a85959c613cce961424e50e1b524b36ce82bfb44cd4f0f00ae547f84ab52201c9fa88d9f70e1a36c81635808895d8b7e1ab7d47f6ab1cca95c
SSDEEP 12288:RDhxrUNCKpoxLfz7SzJHtODOWFg3W/jwG4cxxPtUU+GwGp:xWCcoxjqJHt0Hg3ijwJ4z+Sp
TLSH
T136F47D18AC6C8C10CB161777C589A81E5258AC037BF2D9EF7B8B325B43797F2A5711AC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

570990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

matiex.zip

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

matiex.zip

0b52424adb115b1336d084cf0cfbb73e_JaffaCakes118

mscoree

dotnet