7z2301-x64[.]exe | Triage™

General

Target
7z2301-x64.exe
Size 1.5MB
Sample260730-1dbkmazzht
SHA256 26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd
MD5 e5788b13546156281bf0a4b38bdd0901
SHA1 7df28d340d7084647921cc25a8c2068bb192bdbb
SHA512 1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff
SSDEEP 49152:RoOF3Wh8esAMmyyImtH97VTjrtlEfmSX4b:RoYWh8JAV/VH97F3tlQ+b
TLSH
T1AF7533CC2B03CA29FDC71671E501E4A6DCFF69928D4C978F4B986E98B771531AE10217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7z2301-x64.exe

File Explorer

7z2301-x64.exe

.exe 1.5MB

7z2301-x64.exe

IMPHASH cf0d2de4fd6406302012e0f40060395f
SHA256 26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd
MD5 e5788b13546156281bf0a4b38bdd0901
SHA1 7df28d340d7084647921cc25a8c2068bb192bdbb
SHA512 1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff
SSDEEP 49152:RoOF3Wh8esAMmyyImtH97VTjrtlEfmSX4b:RoYWh8JAV/VH97F3tlQ+b
TLSH
T1AF7533CC2B03CA29FDC71671E501E4A6DCFF69928D4C978F4B986E98B771531AE10217
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

29588

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoCreateInstance CoInitialize

user32

PeekMessageW ExitWindowsEx GetDlgItemTextW SetWindowTextW ShowWindow MessageBoxW CreateDialogParamW LoadIconW SendMessageW GetMessageW EnableWindow GetDlgItem IsDialogMessageW TranslateMessage DispatchMessageW SetDlgItemTextW DestroyWindow

advapi32

RegSetValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueExW RegOpenKeyExW RegCloseKey RegCreateKeyExW

shell32

SHGetFolderPathW SHBrowseForFolderW SHGetPathFromIDListW

msvcrt

_exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _controlfp memcpy memcmp memmove malloc free exit memset

kernel32

ReadFile CloseHandle CreateFileW FormatMessageW WriteFile DeleteFileW CreateDirectoryW GetSystemDirectoryW LoadLibraryW GetModuleFileNameW GetFileAttributesW SetFilePointer GetVersion LoadLibraryExW GetModuleHandleA GetStartupInfoA LocalFree SetFileAttributesW SetFileTime MoveFileExW GetLastError lstrcatW GetCommandLineW lstrcpyW GetModuleHandleW GetProcAddress GetCurrentProcess lstrlenW

Sharing