ServiceControl.exe.zip
- SHA256 da54d59c1c59c85cda2b2823e82374769e7231c6f138d4dbf5ef3ad102e7179f
Password
infected
Static task
static1
1 signatures
General
- Target ServiceControl.exe.zip
- Size 941KB
- Sample260720-rf5f2sew8x
- SHA256 da54d59c1c59c85cda2b2823e82374769e7231c6f138d4dbf5ef3ad102e7179f
- MD5 01e4523a7b26d32adef5ae89f8e17c75
- SHA1 9ac25460f4b03ff2a6f525524b42626461835cd0
- SHA512 dea3b6df2a9aa52e90b58907811b18824e1a4b9c2d60edf9646581c1cbbfe995a3e18f72fe2a1182a910e794315016f56b269f43871add9321d2bbebb78c5820
- SSDEEP 24576:KNPay7KtYDNt/Va/9mmgaCHrCFOL9cUOyjz0eQ1:6/S9mmgNr59lNQ1
- TLSH T146253307CAF6EB74C05D47A0787A490A9C60F39DF66DD499BE80CF908EE72584DD1E28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ServiceControl.exe
File Explorer
-
ServiceControl.exe.zip.zip 941KB
-
ServiceControl.exe.exe 2.3MB
ServiceControl.exe
- IMPHASH 587381bcc13f03399a0ff51ecb192e49
- SHA256 b2c3139ff0237a1d21deda59fc1bb610366c611932c719c73b3071d9990fca54
- MD5 d010b09f394683e9a5ebb5961d1ecb2d
- SHA1 9e9d8be14d446bbcb05b2387a365e7773d42617d
- SHA512 8b1f5fc8a78663fedaaf2a41ad04c62744d25cc08806cbf5bb28311cb40490d48cb47a086060770cbe6a9af60303442125c7cfad2dcddc7c3f1f6d29cdd9b9a9
- SSDEEP 24576:EEByAdUlbP4lDxIQfl0XjRllgUrjC2kF4fWXTkgfH5HIu+1AAwEDs:E8dCcfvell3rjQ4QH5ahw
- TLSH T110B50617AC9104A5F0AD923189669352BA71BC770F2ED3D32A54F2782F73AD49A377C0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
6
Entry point
467040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleFileNameA
GetEnvironmentVariableW
CreateFileW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
938KB
Virtual Size
938KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
89KB
Virtual Size
382KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ