7b74d1500f5d400cfea5da51309c2f56073668d3e8a4ae9f70b5819cb6bba48d

Sharing

Copy URL Twitter E-mail

General

Target
7b74d1500f5d400cfea5da51309c2f56073668d3e8a4ae9f70b5819cb6bba48d
Size 5.7MB
Sample260810-wjer1svale
SHA256 7b74d1500f5d400cfea5da51309c2f56073668d3e8a4ae9f70b5819cb6bba48d
MD5 d2115c1e171fb236863236e007c18ab2
SHA1 54519234015fd34a7699e41417e8fbbd49061d52
SHA512 5c4067b30c096a2a0d2f147988814e225b98eca73d1560c8201aa0a52ec60e39f2f7f66f89dae38e1b911f9587b62574633bdbb71ff4dd863a36af6584504d4a
SSDEEP 98304:7mVxb2M1tqdyFfqkiV+/a13IF3iWsCMVeWK5CS0HobG8uUPDCcu/e0h:qVb1tgyFfqJ13n7VeWBS0Hoy8oc
TLSH
T1C456225263FC4108F6F7BFB26EB912551B7ABCA2A939D24E0600616E5C31F50DE61B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b74d1500f5d400cfea5da51309c2f56073668d3e8a4ae9f70b5819cb6bba48d

File Explorer

7b74d1500f5d400cfea5da51309c2f56073668d3e8a4ae9f70b5819cb6bba48d

.exe 5.7MB

7b74d1500f5d400cfea5da51309c2f56073668d3e8a4ae9f70b5819cb6bba48d

SHA256 7b74d1500f5d400cfea5da51309c2f56073668d3e8a4ae9f70b5819cb6bba48d
MD5 d2115c1e171fb236863236e007c18ab2
SHA1 54519234015fd34a7699e41417e8fbbd49061d52
SHA512 5c4067b30c096a2a0d2f147988814e225b98eca73d1560c8201aa0a52ec60e39f2f7f66f89dae38e1b911f9587b62574633bdbb71ff4dd863a36af6584504d4a
SSDEEP 98304:7mVxb2M1tqdyFfqkiV+/a13IF3iWsCMVeWK5CS0HobG8uUPDCcu/e0h:qVb1tgyFfqJ13n7VeWBS0Hoy8oc
TLSH
T1C456225263FC4108F6F7BFB26EB912551B7ABCA2A939D24E0600616E5C31F50DE61B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30075092

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

2.6MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

254KB

Virtual Size

932KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

36KB

Virtual Size

10.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

37KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

139KB

Virtual Size

884KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

220KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

226KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

191KB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=38, id=241, version=40116,

count=185, id=243, version=40116,

count=33, id=242, version=40116,

count=2, id=261, version=23013,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=259, version=24123,

count=21, id=260, version=24123,

count=373, id=261, version=24123,

count=11, productName=Unmarked objects (old),

count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

count=908, id=1, productName=Unmarked objects,

count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=161, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,