MDE_File_Sample_20b162eb757eab78f87e0253e142b3a23fab0d6d[.]zip

General

Target
MDE_File_Sample_20b162eb757eab78f87e0253e142b3a23fab0d6d.zip
Size 39KB
Sample260805-mt1ykazvb1
SHA256 f9fd9775899cd233570d2de632b41239bca07e417d76aaed51c6a548392d4221
MD5 fa9f6f88a45b0ced0af38e6b10c602e0
SHA1 ca20fbf8a8640ae971a17a4a968fd222429ee09e
SHA512 a863de58d0c8a4776d7ca8bf53ba8721eb4740123e62f4cda0643d5ea9491968c56fefdec61597dd747b2517d47f914e7a2c551f5cbde0837ba8cf3d285ad0c4
SSDEEP 768:oKuv7nA/dTk9lBB66y7j9uxYB0aza9omdms5:oKuv7Ai66yn9uY0azUzmk
TLSH
T16403F1897C3BB4109B113C71E8CA05A61A7B3B18A70F36A3217AC116EF7727836046C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Defender detected and quarantined 'Trojan:MSIL/Lazy.NNL!MTB' in file 'Intreba.SwiftConnect.dll', preventing attempted creation by 'dotnet.exe'

File Explorer

MDE_File_Sample_20b162eb757eab78f87e0253e142b3a23fab0d6d.zip

.zip .js 39KB
Defender detected and quarantined 'Trojan:MSIL/Lazy.NNL!MTB' in file 'Intreba.SwiftConnect.dll', preventing attempted creation by 'dotnet.exe'

.dll 80KB

MDE_File_Sample_20b162eb757eab78f87e0253e142b3a23fab0d6d.zip

SHA256 f9fd9775899cd233570d2de632b41239bca07e417d76aaed51c6a548392d4221
MD5 fa9f6f88a45b0ced0af38e6b10c602e0
SHA1 ca20fbf8a8640ae971a17a4a968fd222429ee09e
SHA512 a863de58d0c8a4776d7ca8bf53ba8721eb4740123e62f4cda0643d5ea9491968c56fefdec61597dd747b2517d47f914e7a2c551f5cbde0837ba8cf3d285ad0c4
SSDEEP 768:oKuv7nA/dTk9lBB66y7j9uxYB0aza9omdms5:oKuv7Ai66yn9uY0azUzmk
TLSH
T16403F1897C3BB4109B113C71E8CA05A61A7B3B18A70F36A3217AC116EF7727836046C7
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

Password

1234

Defender detected and quarantined 'Trojan:MSIL/Lazy.NNL!MTB' in file 'Intreba.SwiftConnect.dll', preventing attempted creation by 'dotnet.exe'

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 208a20ef67af989c1682174832a3ea065859a7ba305d3cd1a0815afef46d97b8
MD5 3db4e939ba2e9d15b248fb4e5bb6be6c
SHA1 20b162eb757eab78f87e0253e142b3a23fab0d6d
SHA512 40241fecb042d0ca6cf13160ea5c066c30721aa36e130519847ce114a16c3cbd91fdd49ef0c10b04c65f24a2e658ddff96709c73d411a108839da307fd2d64ec
SSDEEP 1536:l1VGlCF8Yfj7+kDLSuR2D4D61GOUU85ov3cNLJrk5xSt5IJH:naCF8YfjykDLSuR2D4D61dUU85oENNkV
TLSH
T1C6830A11038887A6F76FDB3DF864476D4B75869A7106FFAE06A8FDCD6DA234608041B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

1234

Minor OS version

0

Major OS version

4

Entry point

87630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Intreba.SwiftConnect.pdb

Sharing