br_mods.rar
- SHA256 80bd3aa12db711c1a104daf73af14c5ca23a0ec023320844b816bdd7acdf35b0
Password
11
Behavioral task
behavioral1
Sample
br_mods.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
General
- Target br_mods.rar
- Size 13.7MB
- Sample260922-prphvs1s3k
- SHA256 80bd3aa12db711c1a104daf73af14c5ca23a0ec023320844b816bdd7acdf35b0
- MD5 dd1595c3fef3d7d1759f6496fb521395
- SHA1 9dd8e6257a30e860c2cfb9a97ecb15206386d5c1
- SHA512 b0898fa5d4b18bbed1a5f4073012938234e47fc679141209b960052e58851bab9294d3808adf191b65917fdeb8400b21fa539e2f9e0be2df6032e0d93f463015
- SSDEEP 393216:XJb+4bRKfHiqVT3A/FNrUpix8L3UqH52x7yITt9:5bxFcHiqlA/XU13Uq4J9
- TLSH T185E633638DFAC1F0B86472744024B15C190BD8BE79A54A8B2867DF71A770CD981FF26B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/br_mods.exe upx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/br_mods.exe
File Explorer
-
br_mods.rar.rar 13.7MB
-
br_mods.exe.exe 16.2MB
br_mods.exe
- IMPHASH 678f13143542700b4830b99e26f57ec0
- SHA256 7bead544df3e7d51b6100267bbb96ecb38e5a160c1f0c6ffde90c0d3e4d56303
- MD5 8a8f6894ce53a3e15b1bc80e471a4a2f
- SHA1 67461b9e94abe9b9a9f41b6ab311759550b14f17
- SHA512 b71324f3038d0a0ead056c9315e07e8dd83959143bc651b8777433b3c22d4b9952123cbcfcd6b70b5b28f3b163223e9562f4d86588756fdf1e15c9a804b4726b
- SSDEEP 196608:iY2ZLmqfuur2KdhIHsWS1kJj2cEDRsxG9HJNGuxA5vrjjco/+w3fXTSyZywzxCz7:ifmc2eyMsGRsxGTxmrBn/tczUfSBt
- TLSH T1F00723C62AEA41ADC086C738EA851BF9E4C9758E4CBD482F7FCB48017532D55CCE6A35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
11
Minor OS version
0
Major OS version
6
Entry point
24090136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetTickCount
user32
MessageBoxW
advapi32
LookupPrivilegeValueW
ntdll
NtResumeProcess
bcrypt
BCryptCreateHash
shell32
ShellExecuteW
urlmon
URLDownloadToFileW
Name
.textbss
Size
Virtual Size
884KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
563B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX0
Size
Virtual Size
10.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
UPX1
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
16.2MB
Virtual Size
16.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ