9rVo4sUkDW[.]zip | Triage™

General

Target
9rVo4sUkDW.zip
Size 6.4MB
Sample260804-hf4p3sysay
SHA256 beee93a7d8be4911d8d1871bd765a61c146db52cf197424f00c6e8d5e99b4f1f
MD5 9e5eb5ef328a08667244643c0864fefb
SHA1 bf48321086a3b1d26fd4d23fa74be37bafb35127
SHA512 6d253bbadbd93f789ca786b4d609a53352ae76720093454e0338f58fc9df01300055a977bd182cea01cbb9d3d7cca087928f1b198acf56316470936b31db2870
SSDEEP 196608:1F+PTh69XB5IckYnMBHE+G/mjQvbWsZ6bKpC7iQ2GLUu97O:b+PTkvIbREkjAZYKA7ywO
TLSH
T12066336AA8D8A14FEF4DF335E309CDA7AD05B22E11612835F5D9045A8CBCAF0F836471
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d9jG3LCbkvhe1V/9rVo4sUkDW.exe

File Explorer

9rVo4sUkDW.zip

.zip 6.4MB
d9jG3LCbkvhe1V/9rVo4sUkDW.exe

.exe 6.5MB

9rVo4sUkDW.zip

SHA256 beee93a7d8be4911d8d1871bd765a61c146db52cf197424f00c6e8d5e99b4f1f
MD5 9e5eb5ef328a08667244643c0864fefb
SHA1 bf48321086a3b1d26fd4d23fa74be37bafb35127
SHA512 6d253bbadbd93f789ca786b4d609a53352ae76720093454e0338f58fc9df01300055a977bd182cea01cbb9d3d7cca087928f1b198acf56316470936b31db2870
SSDEEP 196608:1F+PTh69XB5IckYnMBHE+G/mjQvbWsZ6bKpC7iQ2GLUu97O:b+PTkvIbREkjAZYKA7ywO
TLSH
T12066336AA8D8A14FEF4DF335E309CDA7AD05B22E11612835F5D9045A8CBCAF0F836471
MD5 SHA1 SHA512 SSDEEP TLSH

Password

123

d9jG3LCbkvhe1V/9rVo4sUkDW.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2ce3516e49ab60bfa0f4a90f6be5003a96d44096e26d4effbef90ed5fabe5b55
MD5 a3f9b1cdeca6f8b7916f6e1acf2c42e0
SHA1 f7657ad4f20c44bf3ea322ba584a48df702b2084
SHA512 c6d9018fe33203f20d76f5f81040deeae789374fbad9c4e7d9eecafd86dd74f35fde9496457474d14ba21a0ae5a3b3fb96f23cf954b15e74b1a16858027df339
SSDEEP 196608:6fULHnSl5R5SIWYhaFZIqxhiz0j1aQj21+vMrwWuaz4S:YULH+RSnVIvzC9W+ErW
TLSH
T1EB66333A7EE8E147DF8CE336A55484B19EB0A11A3107D7B2F4E919E62D753F19C22027
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

0

Major OS version

4

Entry point

12237623

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

,-j7%V|*

Size

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

a:KwS&^j

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Z}4=crSl

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

z{I[9@</

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

m~9SLdB<

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

C)yXnz94

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

9rVo4sUkDW.zip

d9jG3LCbkvhe1V/9rVo4sUkDW.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

9rVo4sUkDW.zip

d9jG3LCbkvhe1V/9rVo4sUkDW.exe

mscoree

dotnet