!![.]rar | Triage™

General

Target
!!.rar
Size 863KB
Sample260818-g2m4saxeke
SHA256 7335d21a3dc920a826c5d9e9eb72d05a9f1d4b9bf94dda44cd5746745c733ce2
MD5 b557688737b83b35c8b34d80dfbca582
SHA1 919c966041709fd71f012b9e399c373698d2ac95
SHA512 034502b2a3ad0b4ec412cba20d3b4e9e600e8ff457821cb4e6f1369dda4dc53476a6acc84d6179bbf016732c67ef41f063cd05294dca297b844a64838edebc52
SSDEEP 24576:CfarGpwJTLT9vg3HrRLZDI/3sYKlZDrGvB6g:CWGG3lkLJJI/35KlhKvBj
TLSH
T1CF1523DE01082F2B1CC518A25B3F712891BAC8FBD071E7490AE6386D375692879ED97D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bin/Debug/BOOM.exe

File Explorer

!!.rar

.rar 863KB
bin/Debug/BOOM.exe

.exe 1.8MB
bin/Debug/BOOM.exe.config

189B
bin/Debug/BOOM.pdb

39KB

!!.rar

SHA256 7335d21a3dc920a826c5d9e9eb72d05a9f1d4b9bf94dda44cd5746745c733ce2
MD5 b557688737b83b35c8b34d80dfbca582
SHA1 919c966041709fd71f012b9e399c373698d2ac95
SHA512 034502b2a3ad0b4ec412cba20d3b4e9e600e8ff457821cb4e6f1369dda4dc53476a6acc84d6179bbf016732c67ef41f063cd05294dca297b844a64838edebc52
SSDEEP 24576:CfarGpwJTLT9vg3HrRLZDI/3sYKlZDrGvB6g:CWGG3lkLJJI/35KlhKvBj
TLSH
T1CF1523DE01082F2B1CC518A25B3F712891BAC8FBD071E7490AE6386D375692879ED97D
MD5 SHA1 SHA512 SSDEEP TLSH

bin/Debug/BOOM.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8fb82a1486a09f603a6eb9bab380af0eba79e07c777a5f8c24a75e7605bb3bfc
MD5 d24706c4758c63aa2d512c3685cbfeee
SHA1 84582cc7937a6ffc0ab3cf0e16bf57731a118fba
SHA512 f363a1f60f3c65657f8838d063e7079f44aee9cf7ddb7aeee5ea62437c03576cf651cdf075a866c57a02de3661d99dfb62c7ba2f7f55154582806884f04d108f
SSDEEP 24576:HwKRQXyKnSTp5FWRYCzxwKRQXyKnSTp5FWRYCzV2y:HwKyXgFWqCtwKyXgFWqCZ2
TLSH
T18595F1A2E4CC82C1D5DCBF394F719C15832A9FD53E64610E29DDB869BBBF2D70806609
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1654510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ft305\Desktop\Deminet\obj\Debug\BOOM.pdb

!!.rar

bin/Debug/BOOM.exe

mscoree

dotnet

bin/Debug/BOOM.exe.config

bin/Debug/BOOM.pdb

Sharing

General

Malware Config

Signatures

File Explorer

!!.rar

bin/Debug/BOOM.exe

mscoree

dotnet

bin/Debug/BOOM.exe.config

bin/Debug/BOOM.pdb