s2[.]zip | Triage™

General

Target
s2.zip
Size 602KB
Sample260620-mkb8vafw4s
SHA256 6214366a2e27317342873589a694a9b770c378329c0b38ea83b38a9d1552110c
MD5 e15fcd6a8044a252c4cc0409f0382ff3
SHA1 a89170eeceb7d9aec6204698c03807218438ad3d
SHA512 e8ccb7751794162d3c6bf99b142ff8a781e0399c661746e51a80440b4c8af3884e702168e0be259df2b0eb588b768ced2fe32f80be153d8b8252a7dbb32468ec
SSDEEP 12288:4zZnFeTgriDewPP5U1gIvfl6FPdFaBuP7Zd+aBVw4/IMv1gNDl++ew4BkSeiK:49n0sriTPPOJN2F4BuPP+aBRIMv2NZV5
TLSH
T1FAD4232B1274CBB45C61503B3944745E8727DB826E8F9AB2F84C680A436C7FD5698DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a951afc09aa3e8be61204a027c2cc0c141a64792a2022b8d6ebdf8e0e54a2279.exe

File Explorer

s2.zip

.zip 602KB
a951afc09aa3e8be61204a027c2cc0c141a64792a2022b8d6ebdf8e0e54a2279.exe

.exe 870KB

s2.zip

SHA256 6214366a2e27317342873589a694a9b770c378329c0b38ea83b38a9d1552110c
MD5 e15fcd6a8044a252c4cc0409f0382ff3
SHA1 a89170eeceb7d9aec6204698c03807218438ad3d
SHA512 e8ccb7751794162d3c6bf99b142ff8a781e0399c661746e51a80440b4c8af3884e702168e0be259df2b0eb588b768ced2fe32f80be153d8b8252a7dbb32468ec
SSDEEP 12288:4zZnFeTgriDewPP5U1gIvfl6FPdFaBuP7Zd+aBVw4/IMv1gNDl++ew4BkSeiK:49n0sriTPPOJN2F4BuPP+aBRIMv2NZV5
TLSH
T1FAD4232B1274CBB45C61503B3944745E8727DB826E8F9AB2F84C680A436C7FD5698DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

a951afc09aa3e8be61204a027c2cc0c141a64792a2022b8d6ebdf8e0e54a2279.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a951afc09aa3e8be61204a027c2cc0c141a64792a2022b8d6ebdf8e0e54a2279
MD5 8404ae737e2cf0dd72b36c9cede37a9f
SHA1 bde47864dd96a3108434ef675008716b9198854b
SHA512 77b55bde78ab9d509f86e93f6cc94356b9702b5f5ad3dd34098b02d8d9fcdd424a6e01364cea5cb16eef2bc901492e8bcb0d564e3d649fecc9591708b1e6651e
SSDEEP 12288:vs6JjKlzKi3E13hsBEhijE8wpVlSW/CKR15XpN9w5qNx+j:06Ilb0HsBsxpbrqKR1N9w
TLSH
T1E615CF283DC6564DC5389F75C6731B8837F1D84AD782E30BBEDA30A8891EB96C505E27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

896494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

s2.zip

a951afc09aa3e8be61204a027c2cc0c141a64792a2022b8d6ebdf8e0e54a2279.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

s2.zip

a951afc09aa3e8be61204a027c2cc0c141a64792a2022b8d6ebdf8e0e54a2279.exe

mscoree

dotnet