2f2a2349b896d71b3c176b7a91ddc5b53e3a68e131417a54e03cc111fe075a51

General

Target
2f2a2349b896d71b3c176b7a91ddc5b53e3a68e131417a54e03cc111fe075a51
Size 4.1MB
Sample260922-vae6raygrh
SHA256 2f2a2349b896d71b3c176b7a91ddc5b53e3a68e131417a54e03cc111fe075a51
MD5 3211e51fc548964836ea457f5caec8ce
SHA1 a821276447a6b6318c73fcf0ef8cac13f9335aba
SHA512 648a93ff7dde8510fc2efe7589fe873142a7ea4c83af0b6ec15c99b0fe4fd9cfadf0db2f5086ccb4b29f22cd1c6772ece62d69e8f833f837bc38c784704e8202
SSDEEP 98304:pSjE9cA8Dd4ie/n3SnivkxrcoBcLoJtoXH5Ihcf:p99Jr/3Aisxrhc4tYZIhcf
TLSH
T1021633667133CD8DCB5F8239F965B8602E46912DFB6B6CA87100CF16D18BA36CD02DE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/DiyaDBRestore/RestoreDiyaVPSDB.exe	ConfuserEx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DiyaDBRestore/RestoreDiyaVPSDB.exe

File Explorer

2f2a2349b896d71b3c176b7a91ddc5b53e3a68e131417a54e03cc111fe075a51

.zip 4.1MB
DiyaDBRestore/AniVPSShip.mdf

12.4MB
DiyaDBRestore/AniVPSShip_log.ldf

1024KB
DiyaDBRestore/RestoreDiyaVPSDB.exe

.exe 355KB

2f2a2349b896d71b3c176b7a91ddc5b53e3a68e131417a54e03cc111fe075a51

SHA256 2f2a2349b896d71b3c176b7a91ddc5b53e3a68e131417a54e03cc111fe075a51
MD5 3211e51fc548964836ea457f5caec8ce
SHA1 a821276447a6b6318c73fcf0ef8cac13f9335aba
SHA512 648a93ff7dde8510fc2efe7589fe873142a7ea4c83af0b6ec15c99b0fe4fd9cfadf0db2f5086ccb4b29f22cd1c6772ece62d69e8f833f837bc38c784704e8202
SSDEEP 98304:pSjE9cA8Dd4ie/n3SnivkxrcoBcLoJtoXH5Ihcf:p99Jr/3Aisxrhc4tYZIhcf
TLSH
T1021633667133CD8DCB5F8239F965B8602E46912DFB6B6CA87100CF16D18BA36CD02DE5
MD5 SHA1 SHA512 SSDEEP TLSH

DiyaDBRestore/RestoreDiyaVPSDB.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 aade5410579ebf6b63ee3b4da6a6083088e290abea97429a02a68c5de55f8f77
MD5 91f9268fea4210e9ed3349b696e61c71
SHA1 6a9dec7f530241ec3a2bdc19ef530f062aeb942e
SHA512 b22cb44ca63d6a039d842d18827ad7fb466d9ac3cc66249d191e21d06d2a351da665c5c2985ac43f942f7f3ccea2aa3ef38f5cb7050fe37caeb1ec57f0bbe12f
SSDEEP 6144:OWoyzJ+KMxjn/0CxTin0Ws/LjifWK4kT5cJLcy89mfFWYe0Gu5Suc7NVCT:UIJ+L/0qGUkT5cJAy89mfFoVuc7Nw
TLSH
T179746BDD3610B2DFC967D431DADC5DA8FA60387B471B0123A057A29DAE1C86BCF144EA
MD5 SHA1 SHA512 SSDEEP TLSH

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

393226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

2f2a2349b896d71b3c176b7a91ddc5b53e3a68e131417a54e03cc111fe075a51

DiyaDBRestore/AniVPSShip.mdf

DiyaDBRestore/AniVPSShip_log.ldf

DiyaDBRestore/RestoreDiyaVPSDB.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

2f2a2349b896d71b3c176b7a91ddc5b53e3a68e131417a54e03cc111fe075a51

DiyaDBRestore/AniVPSShip.mdf

DiyaDBRestore/AniVPSShip_log.ldf

DiyaDBRestore/RestoreDiyaVPSDB.exe

mscoree

dotnet