bb7af9b37529e8f734037ce60e7a34fdad0f1ffac5a86a5ab3b2c46941fb52a1

Sharing

Copy URL Twitter E-mail

General

Target
bb7af9b37529e8f734037ce60e7a34fdad0f1ffac5a86a5ab3b2c46941fb52a1
Size 2.4MB
Sample260807-lepfjsbk4v
SHA256 bb7af9b37529e8f734037ce60e7a34fdad0f1ffac5a86a5ab3b2c46941fb52a1
MD5 b40219ad7655e2165c29be5f3841acdb
SHA1 39bad23fc0e9e4de739f459060f786931081bd72
SHA512 4c019d9a32cb39c8ba0b57afbc50cf5711851e18e69ebfac134872c66c33cdfa816b68d2a470eb99acf871dd8e8294c1eb4b192fc3d8095fde6520233a818256
SSDEEP 49152:Hr3TPE10j7zpC/39DfI3sCFCx+WOrXVeeHftudm1rw/fqtTZM0fAyOqQwXEl:Hry0j7zpCPtI8sKOrXVvHfAm1gqtT60g
TLSH
T10EC5333626E47029F0F98B3394B110611923B9B15BECCE9BD519BD0DBD60EE34E96B34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb7af9b37529e8f734037ce60e7a34fdad0f1ffac5a86a5ab3b2c46941fb52a1

File Explorer

bb7af9b37529e8f734037ce60e7a34fdad0f1ffac5a86a5ab3b2c46941fb52a1

.dll 2.4MB

bb7af9b37529e8f734037ce60e7a34fdad0f1ffac5a86a5ab3b2c46941fb52a1

IMPHASH a7d12d8817abd7d18f0906fff0804219
SHA256 bb7af9b37529e8f734037ce60e7a34fdad0f1ffac5a86a5ab3b2c46941fb52a1
MD5 b40219ad7655e2165c29be5f3841acdb
SHA1 39bad23fc0e9e4de739f459060f786931081bd72
SHA512 4c019d9a32cb39c8ba0b57afbc50cf5711851e18e69ebfac134872c66c33cdfa816b68d2a470eb99acf871dd8e8294c1eb4b192fc3d8095fde6520233a818256
SSDEEP 49152:Hr3TPE10j7zpC/39DfI3sCFCx+WOrXVeeHftudm1rw/fqtTZM0fAyOqQwXEl:Hry0j7zpCPtI8sKOrXVvHfAm1gqtT60g
TLSH
T10EC5333626E47029F0F98B3394B110611923B9B15BECCE9BD519BD0DBD60EE34E96B34
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6623232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\RDBuildPool\20251224-20710\build_vs2012\V94_Formal\claud.pdb

Name

Size

959KB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

bbohwzhb

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

jpganmvb

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.taggant

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=4, id=203, version=50929,

count=8, id=205, version=50929,

count=8, id=206, version=50929,

count=3, id=207, version=50929,

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=271, id=1, productName=Unmarked objects,

count=62, id=207, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=11, version=8966,

count=7, id=10, version=8966,

count=1, id=205, productName=VS2012 UPD4 build 61030, version=61030,

count=138, id=207, version=61219,

count=11, id=206, version=61219,

count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,

count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,

count=1, id=151,

count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,

Sharing

General

Malware Config

Signatures

File Explorer

bb7af9b37529e8f734037ce60e7a34fdad0f1ffac5a86a5ab3b2c46941fb52a1

kernel32

generic