fcf1da46d66cc6a0a34d68fe79a33bc3e8439affdee942ed82f6623586b01dd1[.]zip

General

Target
fcf1da46d66cc6a0a34d68fe79a33bc3e8439affdee942ed82f6623586b01dd1.zip
Size 5KB
Sample260714-e8dgtaet8l
SHA256 a4b900a8e8ebc645d9ca90830b428ce42c53a7a10b173bba18d28add3552acfb
MD5 f0dfeb3b38f71d59823551f34b6bf6d1
SHA1 73c82497c2f9155e9ee8b0aacc4d5d716de510c5
SHA512 749c1a7f1ee05953241078aff15e5481079006b5c64483fd7522e89536e5f6e281f2743c0dfda865285638ca07923414fe61f5c1303de64375a8b7bc255e04e7
SSDEEP 96:Y3ZaNN8OLDQFyAGCrfIN8LQ25WyN6WfEhl0ee47Lb8ofpq3cWZc7J3PwInCCcfdI:LN3Ll25hN/e5e4n8ofOVZkwInCCcS
TLSH
T1D4C1AF5CABE40AE2D1A85CE1E70C30440F0FF645DC0FB97E264AFE47963F0D64605956
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fcf1da46d66cc6a0a34d68fe79a33bc3e8439affdee942ed82f6623586b01dd1.exe

File Explorer

fcf1da46d66cc6a0a34d68fe79a33bc3e8439affdee942ed82f6623586b01dd1.zip

.zip 5KB
fcf1da46d66cc6a0a34d68fe79a33bc3e8439affdee942ed82f6623586b01dd1.exe

.exe 14KB

fcf1da46d66cc6a0a34d68fe79a33bc3e8439affdee942ed82f6623586b01dd1.zip

SHA256 a4b900a8e8ebc645d9ca90830b428ce42c53a7a10b173bba18d28add3552acfb
MD5 f0dfeb3b38f71d59823551f34b6bf6d1
SHA1 73c82497c2f9155e9ee8b0aacc4d5d716de510c5
SHA512 749c1a7f1ee05953241078aff15e5481079006b5c64483fd7522e89536e5f6e281f2743c0dfda865285638ca07923414fe61f5c1303de64375a8b7bc255e04e7
SSDEEP 96:Y3ZaNN8OLDQFyAGCrfIN8LQ25WyN6WfEhl0ee47Lb8ofpq3cWZc7J3PwInCCcfdI:LN3Ll25hN/e5e4n8ofOVZkwInCCcS
TLSH
T1D4C1AF5CABE40AE2D1A85CE1E70C30440F0FF645DC0FB97E264AFE47963F0D64605956
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

fcf1da46d66cc6a0a34d68fe79a33bc3e8439affdee942ed82f6623586b01dd1.exe

IMPHASH fb0caaad6f50733b11514c7913cea514
SHA256 fcf1da46d66cc6a0a34d68fe79a33bc3e8439affdee942ed82f6623586b01dd1
MD5 aaffef0dec08f7ef6370f691e2086edb
SHA1 6dc7cf37242d56c99000da5b6e1fb79b2b597804
SHA512 bcbde7dce4f8bbc759fafa074080a2cd4c40ae66ba26a1af545163b736701afe81eb15e2080bda95e6b480af4d7fd6560ba94378a8c3b1153f04e7cc8923b88a
SSDEEP 192:6Pf4jlBkQI4Yarey5GHocGs/rU6toG0cO5tfTclt:6IjP9ISQfIMoG0cL
TLSH
T1EF521A4BBBB649FDE92841B580731A00E2FBB734476253CF57A891211DB23E17C76AC9
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

5496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kumar\source\repos\watchdog\x64\Release\watchdog.pdb

kernel32

CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW CloseHandle CreateProcessW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent RtlCaptureContext

vcruntime140

__C_specific_handler __current_exception __current_exception_context memset memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vfwprintf __acrt_iob_func _set_fmode

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function terminate _seh_filter_exe _set_app_type _c_exit _register_thread_local_exe_atexit_callback _cexit _crt_atexit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Resubmissions

Sharing