MDE_File_Sample_3192b1829272b691afd623af50fc31ae7cb8d080[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
MDE_File_Sample_3192b1829272b691afd623af50fc31ae7cb8d080.zip
Size 750KB
Sample260722-1xnpascf49
SHA256 4145df29f215b31dfd9a8ef484c0dffd9a6bc0913bf007b4397e4d8d909ed26a
MD5 2c587464abe1989ae723359dfa65e70c
SHA1 a92d06e119444d8d57afec9c448b07d2875a0224
SHA512 3dc628c3683302a8dee07a3099e01d55ff3708e5a0e013c1d9fe7ac45b391dab8592abb6c402d42e084fdbbf625c20775c2ab812a9318a8d55b01da009614293
SSDEEP 12288:8nAjzCBIAKH0BEhvI+DF2zaRY/Yls9aWYKlqmdtHdXUIvp4YnXBMnmwo08plAZL+:8n2zIIXnyAY/Ylg3AM91F4Ho0lLPW
TLSH
T120F423CB279F9630CA658731258B684FC3B08F4766448178D93C4985BD04AE3A5FADFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/{E659356C-F7A0-41C1-B3CE-F01BAC41D582}.i

File Explorer

MDE_File_Sample_3192b1829272b691afd623af50fc31ae7cb8d080.zip

.zip 750KB
{E659356C-F7A0-41C1-B3CE-F01BAC41D582}.i

.dll 3.4MB

MDE_File_Sample_3192b1829272b691afd623af50fc31ae7cb8d080.zip

SHA256 4145df29f215b31dfd9a8ef484c0dffd9a6bc0913bf007b4397e4d8d909ed26a
MD5 2c587464abe1989ae723359dfa65e70c
SHA1 a92d06e119444d8d57afec9c448b07d2875a0224
SHA512 3dc628c3683302a8dee07a3099e01d55ff3708e5a0e013c1d9fe7ac45b391dab8592abb6c402d42e084fdbbf625c20775c2ab812a9318a8d55b01da009614293
SSDEEP 12288:8nAjzCBIAKH0BEhvI+DF2zaRY/Yls9aWYKlqmdtHdXUIvp4YnXBMnmwo08plAZL+:8n2zIIXnyAY/Ylg3AM91F4Ho0lLPW
TLSH
T120F423CB279F9630CA658731258B684FC3B08F4766448178D93C4985BD04AE3A5FADFB
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

{E659356C-F7A0-41C1-B3CE-F01BAC41D582}.i

IMPHASH a296cbaca5eedb10423928b73efd01c2
SHA256 3c8513c28e9a81e5d33d37e189aefcbdac767e8706ee67052efc2fdec45a8374
MD5 5eb98ab4f3f89346f8a1aadbbd693c46
SHA1 3192b1829272b691afd623af50fc31ae7cb8d080
SHA512 6504249757fbedcf654d748f82c731f5b27ef90b5e4ea596384eac4e7be6d97dcff536d3cd8803f865812330946afd059db561eb4d06188c3fccc4cbe5d0d27a
SSDEEP 12288:SJQsSc670XM04O4gQDaoJmVCnQDlB5VuwGzoJN5eKG7geCqYPnKspol4tt6PwpGG:eSQCqzB5VuoKNIKSYOti/t
TLSH
T1F1F5802F2568970DD19C107ED3647B0AB9DDE28056B81269FC9770EDCCE268213BA35F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

5040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

266KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

66B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

866KB

Virtual Size

865KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

MDE_File_Sample_3192b1829272b691afd623af50fc31ae7cb8d080.zip

{E659356C-F7A0-41C1-B3CE-F01BAC41D582}.i

kernel32

msvcrt

generic