1037cf300960e457122598fdeea6cc42626d8a5a8f27e31e7e7617569fa2272a

General

Target
1037cf300960e457122598fdeea6cc42626d8a5a8f27e31e7e7617569fa2272a
Size 110KB
Sample260818-dcqltsfa75
SHA256 1037cf300960e457122598fdeea6cc42626d8a5a8f27e31e7e7617569fa2272a
MD5 aaf9f9997dddc860fd75ca2efb455e47
SHA1 a73d937a38c4ad52146ab99f716bdf607f2c8eec
SHA512 fd34d7b9a9fe5209fc2cbe22df25b40c6e1599752eed2f9b98a4cf0e2a2ab7a959be2ef08b17f37a58e3f3c8ec99cd77e84def23d2e4553ba0bddb1edee1ea92
SSDEEP 1536:hlUu0kF2WA5aBTDcnb0+Cl7yW+KRslNi6NE1Z2blM5L/lLrfzfavETsUylQW9hNW:hiu0ShBPcnAtyhKRsIB/lPzfaMoq
TLSH
T13BB313134E625D2FB7A79E7104D38BD3082C590FE0B11AD79936E6AC7856B0C1EBB94C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/SynapticsKiller.com	ConfuserEx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SynapticsKiller.com

File Explorer

1037cf300960e457122598fdeea6cc42626d8a5a8f27e31e7e7617569fa2272a

.zip 110KB
SynapticsKiller.com

.exe 146KB

1037cf300960e457122598fdeea6cc42626d8a5a8f27e31e7e7617569fa2272a

SHA256 1037cf300960e457122598fdeea6cc42626d8a5a8f27e31e7e7617569fa2272a
MD5 aaf9f9997dddc860fd75ca2efb455e47
SHA1 a73d937a38c4ad52146ab99f716bdf607f2c8eec
SHA512 fd34d7b9a9fe5209fc2cbe22df25b40c6e1599752eed2f9b98a4cf0e2a2ab7a959be2ef08b17f37a58e3f3c8ec99cd77e84def23d2e4553ba0bddb1edee1ea92
SSDEEP 1536:hlUu0kF2WA5aBTDcnb0+Cl7yW+KRslNi6NE1Z2blM5L/lLrfzfavETsUylQW9hNW:hiu0ShBPcnAtyhKRsIB/lPzfaMoq
TLSH
T13BB313134E625D2FB7A79E7104D38BD3082C590FE0B11AD79936E6AC7856B0C1EBB94C
MD5 SHA1 SHA512 SSDEEP TLSH

SynapticsKiller.com

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1a40f4bf72642956ddffd33a917c078f94fae65f04b269e03f519d49e4e5dd9d
MD5 1c1cbbc2a01709753c2eed740ecfbe03
SHA1 c74e90ba774f41cf54fb1a64880ef1a0a98eeb6a
SHA512 41ae34c5662f06cf27fecce52ce498e167c210db8803a9fed2e787d4dfdaa8c6db47773f4fdf13e5de627bf6e034da1bd5a469c2a65826e9e5ae60578452768b
SSDEEP 3072:7C5wv4WBreEThtyhKRsx8CGE7Z8WToQiNHin+zbH7X3TE:7VwWBreiywRbCGPWEvHin+zbH7X3
TLSH
T1E1E3078C766072DFC86BC976CAA81CA4EA50747B531BD213A45326ED9E4C99BCF140F3
MD5 SHA1 SHA512 SSDEEP TLSH

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

155454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

1037cf300960e457122598fdeea6cc42626d8a5a8f27e31e7e7617569fa2272a

SynapticsKiller.com

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

1037cf300960e457122598fdeea6cc42626d8a5a8f27e31e7e7617569fa2272a

SynapticsKiller.com

mscoree

dotnet