e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481[.]7z

General

Target
e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481.7z
Size 246KB
Sample260701-zy23msgv4x
SHA256 3d4fbed6f8d7288b4c6b08d565b36ee116bb15a2c31b3ab0ea9f2974cb6a32a8
MD5 363274993b04b7afd924bb64c1a7795c
SHA1 1d3fbf360e18adbd5b71271c1fbbfb10f8515cba
SHA512 079fcfa48ccad12303d3cb090dc4cbd70417cc5aaa21afa89779b44bbe801eea7ca619f4067e1530825233e435f77d60a8e9ef405fcf06f1f5872cfdf0c6426f
SSDEEP 6144:wQwPUdvwDvNLJp1/EQZCNimROd8QH6n3aAoYjo1jnb2F+3h:HoUdv6LJr/EQYNDROdDH6nToFjbIc
TLSH
T1D134236C8107C7B85789B5B6C88841AB606FFC3D771DE4C0DCD1D3E84F12AA6B4A4A63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481

File Explorer

e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481.7z

.7z 246KB
e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481

.exe 543KB

e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481.7z

SHA256 3d4fbed6f8d7288b4c6b08d565b36ee116bb15a2c31b3ab0ea9f2974cb6a32a8
MD5 363274993b04b7afd924bb64c1a7795c
SHA1 1d3fbf360e18adbd5b71271c1fbbfb10f8515cba
SHA512 079fcfa48ccad12303d3cb090dc4cbd70417cc5aaa21afa89779b44bbe801eea7ca619f4067e1530825233e435f77d60a8e9ef405fcf06f1f5872cfdf0c6426f
SSDEEP 6144:wQwPUdvwDvNLJp1/EQZCNimROd8QH6n3aAoYjo1jnb2F+3h:HoUdv6LJr/EQYNDROdDH6nToFjbIc
TLSH
T1D134236C8107C7B85789B5B6C88841AB606FFC3D771DE4C0DCD1D3E84F12AA6B4A4A63
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481

IMPHASH bc5a584cac4f34dae8014259006fd0d3
SHA256 e3fa93dad8fb8c3a6d9b35d02ce97c22035b409e0efc9f04372f4c1d6280a481
MD5 b0a59e8b365962c73da486bccc361354
SHA1 fd5c34344773989c88a0af60177acf06a7a74b80
SHA512 0757e18954122346bd97d829105a2d0d97c9640a6d9c712689eddc2bd3da4f1d896b6bc96dcfd7313e6b91572f234dfa0133294c7c751ac2cc4f3d73f23d1e2c
SSDEEP 6144:JDpYW09Y6VTU5GKmHhfSvqDxXKwBm7Y4yaXRvkDWtVKdkVNwXO9mrmcFRzzrpZY:JD89YsTi9iNKwBm7PhvxKdo9mCc7rp
TLSH
T19BC47C56EA8515F8D06AC0B083469633B9357C8A0735BDFF07E466322E39AE16F3DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

323948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\1 Projects\rust\megazord_xi-1\Windows\x86_64-pc-windows-msvc\release\deps\megazord.pdb

bcrypt

BCryptGenRandom

advapi32

SystemFunction036 OpenSCManagerA EnumServicesStatusA CloseServiceHandle

kernel32

CreateEventW FindClose QueryPerformanceCounter GetLastError GetSystemInfo GetLogicalDriveStringsA Sleep AddVectoredExceptionHandler SetThreadStackGuarantee HeapAlloc GetProcessHeap HeapFree HeapReAlloc SwitchToThread AcquireSRWLockExclusive ReleaseSRWLockExclusive MoveFileExW SetFilePointerEx CloseHandle WaitForSingleObject SetLastError GetFinalPathNameByHandleW FindFirstFileW GetModuleHandleA GetProcAddress GetCurrentThread TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode MultiByteToWideChar WriteConsoleW GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA CreateMutexA GetCurrentProcess ReleaseMutex GetEnvironmentVariableW RtlLookupFunctionEntry GetModuleHandleW FormatMessageW GetModuleFileNameW GetCommandLineW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle GetCurrentProcessId CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx WaitForMultipleObjects GetOverlappedResult GetExitCodeProcess CancelIo ReadFile ExitProcess QueryPerformanceFrequency GetSystemTimeAsFileTime RtlCaptureContext AcquireSRWLockShared ReleaseSRWLockShared SetConsoleMode WakeAllConditionVariable GetConsoleScreenBufferInfo SetConsoleTextAttribute GetConsoleOutputCP FlushFileBuffers HeapSize GetCurrentThreadId InitializeSListHead RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

Sharing