cbe6e20db777758a46b3137e0b494d2de96945b6d6bd11f6bfeef12702a63431

Sharing

Copy URL Twitter E-mail

General

Target
cbe6e20db777758a46b3137e0b494d2de96945b6d6bd11f6bfeef12702a63431
Size 3.4MB
Sample260731-fdte8acg85
SHA256 cbe6e20db777758a46b3137e0b494d2de96945b6d6bd11f6bfeef12702a63431
MD5 341cab55f5dde04bd0fce062c677fa66
SHA1 ff8438c1a65764ed9dc301d2915eae459dfb2880
SHA512 d0f21273ea4deebcc606dff1312afab5f5ae1eb906a0ecd0e8dbf3882feade3345d80a9a5c6ddbb32a4da904b612972ce5c5d1282fdfe832e41e0f8ded94eb94
SSDEEP 98304:GkIf767ajN4qxgUuJraKOpPG4fBV06ba9+EG:GJ+ahiUuJUpP/BVq7G
TLSH
T1FBF533F9C1696CC8F0D0CE9F6DD1A8C6D9474EECC77340C504836B89E854E9D4AAB86E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/agent.exe

File Explorer

cbe6e20db777758a46b3137e0b494d2de96945b6d6bd11f6bfeef12702a63431

.zip 3.4MB
agent.exe

.exe 8.1MB

cbe6e20db777758a46b3137e0b494d2de96945b6d6bd11f6bfeef12702a63431

SHA256 cbe6e20db777758a46b3137e0b494d2de96945b6d6bd11f6bfeef12702a63431
MD5 341cab55f5dde04bd0fce062c677fa66
SHA1 ff8438c1a65764ed9dc301d2915eae459dfb2880
SHA512 d0f21273ea4deebcc606dff1312afab5f5ae1eb906a0ecd0e8dbf3882feade3345d80a9a5c6ddbb32a4da904b612972ce5c5d1282fdfe832e41e0f8ded94eb94
SSDEEP 98304:GkIf767ajN4qxgUuJraKOpPG4fBV06ba9+EG:GJ+ahiUuJUpP/BVq7G
TLSH
T1FBF533F9C1696CC8F0D0CE9F6DD1A8C6D9474EECC77340C504836B89E854E9D4AAB86E
MD5 SHA1 SHA512 SSDEEP TLSH

agent.exe

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 6115c4e7883c70fbdb34ae01349ce1ba586ed19199a725edd7e3f3b1c4ac6884
MD5 2a3c6992fdcdf6e33771e048bd4e6d4e
SHA1 712b992c402ed223d7d4864bba424449553b819c
SHA512 df38db176623d37481bc9460a56ea8cf1e55bae52a9c5624dbfc50d683d090c33a86985c79a0884e92b51ba10b6ecf6f615f8606f2fd3406275bffb452b3ca96
SSDEEP 49152:bZ99Rj7Nr/i3borXdQfdTVUQyn/N/OKCqmeCxOUMUDEL1MXaO+SW5lHkPPXFkIV9:bZ933RAZIZsILbHmXvZACSEKEhsA
TLSH
T1AE863A87FCA514E9C0BDD33685629152BB717C494B2123D72B90FB283E36BD0AEB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

551872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

451KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

cbe6e20db777758a46b3137e0b494d2de96945b6d6bd11f6bfeef12702a63431

agent.exe

kernel32

generic