49b743fc85a2f5b83f079df8205ba3022cf1a3243bfd52b2b12be1e0e83572dc
- SHA256 49b743fc85a2f5b83f079df8205ba3022cf1a3243bfd52b2b12be1e0e83572dc
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 49b743fc85a2f5b83f079df8205ba3022cf1a3243bfd52b2b12be1e0e83572dc
- Size 229KB
- Sample260812-rn3meswzat
- SHA256 49b743fc85a2f5b83f079df8205ba3022cf1a3243bfd52b2b12be1e0e83572dc
- MD5 66cef6be6cec4121c906d3d273709a22
- SHA1 335e471a000f535d2d09e4549e3023f192224e6e
- SHA512 2dfc7207a57cc84aee331166890e5c52ed353cd133d7c4f8fddb9af27f1a71c998bc05bfe420e7b940634782beaf848e60f703af087c4a49b1ab77f40130afaf
- SSDEEP 6144:Beyv3R1gjFjDjP+FSKQVSxT6/dMmD5ymI:BeY1gF3wtDj
- TLSH T1CB3423DBF29E3DBA2331D9556456AE237BD81DF3A218B1D5A5C7CC0140164F9F0218EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
File Explorer
-
49b743fc85a2f5b83f079df8205ba3022cf1a3243bfd52b2b12be1e0e83572dc.zip 229KB
-
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe.exe 363KB
ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0.exe
- IMPHASH 48e935e4a7ca5310c5d8cee6f2c32848
- SHA256 ac457fc7c907ca04a4aa2e243d4b5120c58d338b44771c84e0d282d625d463a0
- MD5 7f152df418bbb484337fc8ed1383b27d
- SHA1 fc433e7db24eb38690746575375d9890457e6711
- SHA512 b6ebda7bd92d7248f18d796b808d0fd2cd7e1914ad51e3e3f2a0512a0d0a17e9b4bf6dd0d3e7cb1f239489d52ac5e666e17c27ab66b04a3ac0bd0783efef0f97
- SSDEEP 6144:/jacJsdErLrLrLUP3ZkWgQqo8aIj1V/HqivMTmrF9rI8iV50DErhNg/ydlb4fQ6p:xei1KIJBKhm5BDANg6dNoQl+v
- TLSH T133848D16E9C3E7FDDD0B4972809E633E4D7759142E118EB7E3D06628E0A29437B63329
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
136112
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxA
GetForegroundWindow
wsprintfA
PostQuitMessage
ShutdownBlockReasonCreate
DefWindowProcA
EnumChildWindows
wsprintfW
AdjustWindowRect
ShutdownBlockReasonDestroy
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
DispatchMessageA
CloseWindow
ReleaseDC
AnimateWindow
DestroyWindow
DeferWindowPos
MessageBoxW
gdi32
SetPixel
DeleteObject
SelectPalette
SetPaletteEntries
GetDeviceCaps
kernel32
lstrcpyA
lstrcatA
VirtualFree
GetProcAddress
WaitForSingleObject
lstrlenW
CreateDirectoryW
GetLastError
TlsGetValue
TlsSetValue
CreateFileW
WriteFile
lstrcpynW
lstrcatW
FindNextFileW
lstrcmpW
CloseHandle
FindClose
GetTickCount
ExitThread
CreateThread
LocalAlloc
OutputDebugStringW
LoadLibraryA
HeapAlloc
VirtualAlloc
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleHandleW
GetSystemDirectoryW
CreateProcessW
GetShortPathNameW
GetModuleHandleA
Sleep
lstrlenA
GetCurrentProcessId
VirtualQuery
VirtualProtect
IsBadReadPtr
FreeLibrary
lstrcmpA
AllocConsole
GetStdHandle
WriteConsoleW
UnmapViewOfFile
lstrcmpiW
lstrcpyW
SetFileAttributesW
MoveFileExW
FindFirstFileW
WaitForMultipleObjects
GetDriveTypeW
GetTickCount64
SetThreadExecutionState
GetCommandLineW
CreateMutexW
GetFileSizeEx
IsProcessorFeaturePresent
ReadFile
CreateFileMappingW
MapViewOfFile
GetCurrentProcess
LocalFree
GetUserDefaultUILanguage
InitializeCriticalSection
DeleteCriticalSection
SetLastError
EnterCriticalSection
LeaveCriticalSection
TerminateThread
GlobalAlloc
GlobalFree
Beep
GetVersionExA
ExpandEnvironmentStringsW
ExitProcess
SetFilePointerEx
advapi32
LsaAddAccountRights
LookupAccountSidW
LsaCreateTrustedDomainEx
EncryptionDisable
LsaQueryTrustedDomainInfo
CryptDecrypt
CryptEncrypt
CryptImportKey
GetSidSubAuthority
GetSidSubAuthorityCount
CryptReleaseContext
CryptDestroyKey
CryptExportKey
CryptGenKey
CryptAcquireContextW
LsaFreeMemory
LsaClose
CryptGenRandom
EqualDomainSid
AreAllAccessesGranted
shell32
ShellExecuteExW
SHGetFolderPathW
secur32
LsaConnectUntrusted
netapi32
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
shlwapi
StrStrW
StrToIntA
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
WNetAddConnection2W
ws2_32
shutdown
closesocket
connect
htons
inet_addr
WSAGetLastError
WSACleanup
socket
WSAStartup
inet_pton
send
gethostbyname
inet_ntoa
recv
wininet
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
crypt32
CryptBinaryToStringW
CryptBinaryToStringA
CryptStringToBinaryA
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
VariantClear
VariantInit
Name
.text
Size
232KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=208, version=65501,
count=2, id=225, version=20806,
count=5, id=223, version=20806,
count=2, id=224, version=20806,
count=29, id=203, version=65501,
count=165, id=1, productName=Unmarked objects,
count=49, productName=Unmarked objects (old),
count=1, id=222, productName=VS2013 build 21005, version=21005,