a6b08f633ad63cbe5f98abb2269cdecdd85c7c93255ee784f14e871af33d7d35.zip
- SHA256 e4d7acf4994e55b801dda9d98e7a57c72b24215e066b61270cd5513c2bb96197
Password
infected
Static task
static1
1 signatures
General
- Target a6b08f633ad63cbe5f98abb2269cdecdd85c7c93255ee784f14e871af33d7d35.zip
- Size 1.6MB
- Sample261002-w2hlmaxs2p
- SHA256 e4d7acf4994e55b801dda9d98e7a57c72b24215e066b61270cd5513c2bb96197
- MD5 72f698ba57f0abf979b81ee9050c1ea8
- SHA1 f13817905e29610364fe0dd224be69065d5258c8
- SHA512 7cd129552bd91c28e1739cfc29bd8ad560fc0f33186175886beed0cf563180a5617a8f32f787768dc35d7e338469f59eeb5e6cf6f545f303038c713873840789
- SSDEEP 49152:rUhmc1fjx+4pYvIt03si5AiLNWHf0Fvk4:QmcljxYIysi5AiLY/684
- TLSH T1E5753375F7229DF5E89246EACDC519A2C42733B629865BC1BCC6A3D183DDFC608C9C42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/a6b08f633ad63cbe5f98abb2269cdecdd85c7c93255ee784f14e871af33d7d35.exe
File Explorer
-
a6b08f633ad63cbe5f98abb2269cdecdd85c7c93255ee784f14e871af33d7d35.zip.zip 1.6MB
-
a6b08f633ad63cbe5f98abb2269cdecdd85c7c93255ee784f14e871af33d7d35.exe.exe 1.6MB
a6b08f633ad63cbe5f98abb2269cdecdd85c7c93255ee784f14e871af33d7d35.exe
- IMPHASH 013c74198fc6e42dcf33737d6c40c012
- SHA256 a6b08f633ad63cbe5f98abb2269cdecdd85c7c93255ee784f14e871af33d7d35
- MD5 7f4ce93930e8a11edbc5f4c541bacd1a
- SHA1 7885b0bfff6a373b82c229a5e8d9e2b20ae44e7f
- SHA512 886830a3015b8e67ce3f521dffdf8b9a20c9142377058b07ebbbd7dcdd3dfc6a474a4a2dd07604ea1522cd027a8aace6758cbecb858054f2ea068ab1a7d54ef3
- SSDEEP 24576:FXTV5JftJdWXSXgzsJohbSwxxmhROMcCGfr5tv6mEpvttGtzEif2qK4+ptR:xJfIXSXgzsKhbzMcCGjmtaCd4+p
- TLSH T14C7523E253E410AAE4FD977948FA8323C731FC4557B4968F2314D9CA0F226D47A307AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
3
Major OS version
6
Entry point
32960
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wextract.pdb
advapi32
OpenProcessToken
GetTokenInformation
RegSetValueExA
EqualSid
RegQueryValueExA
LookupPrivilegeValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteValueA
AllocateAndInitializeSid
FreeSid
AdjustTokenPrivileges
RegCloseKey
kernel32
GetPrivateProfileIntA
GetFileAttributesA
IsDBCSLeadByte
GetSystemDirectoryA
GlobalUnlock
GetShortPathNameA
CreateDirectoryA
FindFirstFileA
GetLastError
GetProcAddress
RemoveDirectoryA
SetFileAttributesA
GlobalFree
FindClose
GetPrivateProfileStringA
LoadLibraryA
LocalAlloc
WritePrivateProfileStringA
GetModuleFileNameA
FindNextFileA
CompareStringA
_lopen
CloseHandle
LocalFree
DeleteFileA
ExitProcess
DosDateTimeToFileTime
CreateFileA
FindResourceA
SetFilePointer
GlobalAlloc
ExpandEnvironmentStringsA
WaitForSingleObject
SetEvent
GetModuleHandleW
FormatMessageA
SetFileTime
WriteFile
GetDriveTypeA
GetVolumeInformationA
TerminateThread
SizeofResource
CreateEventA
GetExitCodeProcess
CreateProcessA
ReadFile
SetCurrentDirectoryA
_llseek
ResetEvent
LockResource
GetSystemInfo
LoadLibraryExA
CreateMutexA
GetCurrentDirectoryA
GetVersionExA
GetVersion
GetTempPathA
CreateThread
LocalFileTimeToFileTime
Sleep
FreeResource
GetWindowsDirectoryA
lstrcmpA
_lclose
GlobalLock
GetCurrentProcess
LoadResource
FreeLibrary
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
OutputDebugStringA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
MulDiv
GetDiskFreeSpaceA
GetTempFileNameA
gdi32
GetDeviceCaps
user32
SetForegroundWindow
MsgWaitForMultipleObjects
SendDlgItemMessageA
GetWindowLongPtrA
GetWindowRect
GetDC
MessageBoxA
PeekMessageA
ReleaseDC
GetDlgItem
SetWindowPos
ShowWindow
SetWindowLongPtrA
DispatchMessageA
SetWindowTextA
EnableWindow
CallWindowProcA
DialogBoxIndirectParamA
GetDlgItemTextA
LoadStringA
MessageBeep
CharUpperA
CharNextA
ExitWindowsEx
CharPrevA
EndDialog
GetDesktopWindow
SetDlgItemTextA
SendMessageA
GetSystemMetrics
msvcrt
?terminate@@YAXXZ
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
memset
memcpy
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_errno
_vsnprintf
_commode
comctl32
ord17
cabinet
ord22
ord23
ord21
ord20
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=205, version=65501,
count=65, id=206, version=65501,
count=16, id=207, version=65501,
count=17, id=203, version=65501,
count=211, id=1, productName=Unmarked objects,
count=9, id=210, version=65501,
count=1, id=126, version=50727,
count=1, id=201, version=65501,
count=1, id=204, version=65501,