agent_bundle.zip
- SHA256 f2c691492be88c7a95453820a7e65d7b0d6804b63f330ba80a1eea7772717750
Static task
static1
1 signatures
General
- Target agent_bundle.zip
- Size 1.8MB
- Sample260624-a6e6eahw4x
- SHA256 f2c691492be88c7a95453820a7e65d7b0d6804b63f330ba80a1eea7772717750
- MD5 d7d501a90042009f49d9801e250ad054
- SHA1 889c85039c1ed863b44d556fc1b84c77b37905a7
- SHA512 ff46e7b943e1687f359be742131ec036ddce9a839e00508591ea429735106d7a05ed86a3df521cc19da98f94d40e99fe13851f96d9f3e4943851d4f07595be4d
- SSDEEP 49152:c10OJPgRAQfrSZuIfDPQ/3/XPtsuZIH1OE4/ZB/e:EdJPguQf3ITQHXFuMEqde
- TLSH T1278533F3F8F5B874FF27C03422A8BC0AA02181B6D6C54DB16A5B5097E2BC6E0B585F45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/agent.exe
File Explorer
-
agent_bundle.zip.zip 1.8MB
-
agent.exe.exe 24KB
-
hda_config.dat1.7MB
agent.exe
- IMPHASH 599182932030e8af4cd0440fad8e91bf
- SHA256 b23005a1ad8ff12df7b55ae619c3027a8ae4a3de91688e0d10a131ca8d1d0209
- MD5 5f40d9f17c35c93e7eb9544f37f651c1
- SHA1 bcdbad96d5a2602ec40a2ba16b4908d03f0b25ba
- SHA512 9a8f4a99f419cd64a42d97c2957ad7ff04af3601df31fabd9471cbc87a403b761558e79389277b52eedb598d56a0b78607ffcdebbb0b4fd6d3c1148c026d99a2
- SSDEEP 384:V+zGxJV3YoXQpohuVhEIB8xo8qeaRBwM3Z4lh2Nb1Z0T7IV3a0s:V+k6bE5etBwrSpzm0Vq0
- TLSH T153B2F60BF79790FDC45BC2B146677273BA73BC1911396A1F0358D6306E60B40AA7EE49
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RegCloseKey
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
kernel32
CloseHandle
CreateFileA
DeleteCriticalSection
EnterCriticalSection
GetComputerNameA
GetCurrentDirectoryA
GetCurrentProcessId
GetFileSize
GetLastError
GetLogicalDrives
GetModuleFileNameA
GetProcessHeap
GetStartupInfoA
GetSystemInfo
GetSystemTime
GetTempPathA
GetTickCount
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
ReadFile
SetUnhandledExceptionFilter
Sleep
SleepEx
SystemTimeToFileTime
TlsGetValue
WriteFile
__C_specific_handler
msvcrt
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_fmode
_initterm
_onexit
calloc
exit
fprintf
free
malloc
memcpy
signal
strlen
strncat
strncmp
strncpy
user32
GetSystemMetrics
wsprintfA
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
492B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
428B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
hda_config.dat
- SHA256 cca78073b6ef8e75ef07255906e6ebd6e84c19826241481276befbc39ec4ff7f
- MD5 70bd523886838b7e9fed5274b41aa198
- SHA1 8a6027d7f050b4daf6864ca9a1a8288c7cfc3f2b
- SHA512 3ea9f8c8b4319d2f4b6b3075abaac97e50c0f1be51fadaf82a895c2fbe359724ea109618a7f3047dc1cf333415b2c9fe854862e12a4b684217dcac6f6dbc5f3b
- SSDEEP 49152:fhAEl1gZO8fPWrKmfFVQfVltzbuk5u592E4/xBbX:p3l1g88fVm/QDtf+yEEhX
- TLSH T1138533F3F4E5B875FF27C03422A8B80AA0218176D6D54DB26B9B5097E2FC6E0B584F45
- MD5 SHA1 SHA512 SSDEEP TLSH