IttihadCPL[.]7z | Triage™

General

Target
IttihadCPL.7z
Size 967KB
Sample260802-d55lfscf28
SHA256 f535325100ad36c2c55dcaa9bba67a4157c891069eb49160d943a0f1e21e97ec
MD5 e822ea037bb642717e66ef0ea97d2049
SHA1 7ca88a81b90d88f8ff3fccd142544a9030961de5
SHA512 f559ed5f2647cb68572741f8924bb4b153158e5e139930a23bf9f303771aa9e08a48a1c1da40a2126ef5b6461108ca552db6f0b0f61c41d7a94a9b32537b38bc
SSDEEP 24576:S24h8pQVnZmK8fzbQ5llg2HQIuQX3HV4NGlctHx8cig0Jy7x:74hVnZmhfz62dItnHu2+RtibJCx
TLSH
T1152533846771D5ABAB7F1D506C045168FDC8C182EA98CE235F8140EAAE6483FF05DADE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/zbe.Deobf.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/Guna.UI2.dll

File Explorer

IttihadCPL.7z

.7z 967KB
Guna.UI2.dll

.dll 2.1MB
zbe.Deobf.exe

.exe 834KB

IttihadCPL.7z

SHA256 f535325100ad36c2c55dcaa9bba67a4157c891069eb49160d943a0f1e21e97ec
MD5 e822ea037bb642717e66ef0ea97d2049
SHA1 7ca88a81b90d88f8ff3fccd142544a9030961de5
SHA512 f559ed5f2647cb68572741f8924bb4b153158e5e139930a23bf9f303771aa9e08a48a1c1da40a2126ef5b6461108ca552db6f0b0f61c41d7a94a9b32537b38bc
SSDEEP 24576:S24h8pQVnZmK8fzbQ5llg2HQIuQX3HV4NGlctHx8cig0Jy7x:74hVnZmhfz62dItnHu2+RtibJCx
TLSH
T1152533846771D5ABAB7F1D506C045168FDC8C182EA98CE235F8140EAAE6483FF05DADE
MD5 SHA1 SHA512 SSDEEP TLSH

Guna.UI2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bae60184a9514418d6a442549d2de35dcd753a79b7b57c018946fe8790f654cd
MD5 bb8f806621637a5a6339bafa3be99238
SHA1 74fc30dc004c6f64c0c9ce096d289ce6f0c0c1d5
SHA512 fc3795048b59a67d24baa7e0dfe5e357ddb2e1d079feb8fff1f07f9bbaaa5011f18b5f92eb6c5174b320e7ee6dfb4a88bfa43fe4eeca84cc07a5e15001d964dd
SSDEEP 24576:Wv9BnJMxNmwiDVobBJbUJ5A+I9Y8PglCdMPmBUVLqiraPNc2NX1fk8gLlyF9HQ/M:Ifm9PEJyFL
TLSH
T18BA5F8187DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66D3576C18427867C863AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bc:27:fa:c6:5e:d5:ce:5a:48:33:16:91:d8:1a:e4:da:1e:93:8f:6f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

2195694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

zbe.Deobf.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 03fcf806eb56514542d942e1384693d83ff7ba772de5c4a1e89e62c3a386c29a
MD5 455ad4887eefaa0b5fb80eb989630665
SHA1 48f8aa63a32fa4431b3dfc9444bba72ac0d13290
SHA512 a10a29a2740de906e2f307ba3fd1c05f41d08872943677e08e83357fe13a61fa5931ff09d80e60cb056ccf4b6ff925202eb873a163a300c0a04cc2e4a248cc78
SSDEEP 12288:B+0i0+0NeUZtHknAjIaqAg8GxPTfb3ImHhmcLB2:B+0H+0zZtHknxgPiPn3IWM
TLSH
T14F05B1C87E77512FEF99D93A6814B01E196CAEE1D68E9116F2FC3E0B75B46203450AF0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

855534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

IttihadCPL.7z

Guna.UI2.dll

PE Signature issue

mscoree

dotnet

zbe.Deobf.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

IttihadCPL.7z

Guna.UI2.dll

PE Signature issue

mscoree

dotnet

zbe.Deobf.exe

mscoree

dotnet