KJ-w0rm v2[.]0[.]7z

General

Target
KJ-w0rm v2.0.7z
Size 936KB
Sample261011-2ls1baad99
SHA256 d6c7267b74c7ccb7d8c67030a211b918c5dc5846c1b0adb376534c3684d573cb
MD5 dd34217c3b3e766118865133ddc3862b
SHA1 167e00a017eb6d48eaea4a7eddf5369f33cfb21c
SHA512 453f29ba124ff1956416dfe1cd6452760d6930088bfde26ea864d85fe0a6e63b55e6a74671d30d3471830fd18ebaa3c44e940241b65c4a89f56f22775835747c
SSDEEP 24576:4sJ/RT52V3bk/mVmO/RiqrnTAYC76D8Zm+6:42Qpb3PigTNQeD
TLSH
T17315339A033C96F5D3BF6D7B89EAEFBD17322F216D89181207C9E5076C5740E029B489
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/KJ-w0rm V2.0.exe

File Explorer

KJ-w0rm v2.0.7z

.7z 936KB
GeoIP.dat

1.2MB
KJ-w0rm V2.0.exe

.exe 531KB

KJ-w0rm v2.0.7z

SHA256 d6c7267b74c7ccb7d8c67030a211b918c5dc5846c1b0adb376534c3684d573cb
MD5 dd34217c3b3e766118865133ddc3862b
SHA1 167e00a017eb6d48eaea4a7eddf5369f33cfb21c
SHA512 453f29ba124ff1956416dfe1cd6452760d6930088bfde26ea864d85fe0a6e63b55e6a74671d30d3471830fd18ebaa3c44e940241b65c4a89f56f22775835747c
SSDEEP 24576:4sJ/RT52V3bk/mVmO/RiqrnTAYC76D8Zm+6:42Qpb3PigTNQeD
TLSH
T17315339A033C96F5D3BF6D7B89EAEFBD17322F216D89181207C9E5076C5740E029B489
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

KJ-w0rm V2.0.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 362454c019d71539287d50d763260dc586c0a8834952cf90e8e58341cd668550
MD5 72a5c7af0afb7995d579a6d7022e6a9a
SHA1 b579ac4af93cc0212ed00c6468e948810bce0d27
SHA512 7507b6187b775075415b40896dca0fe0de9b84cf0d43b7687ab9a8361fb6a4dedd3422250d882842ac4948a9c2ce2dcee564fcceacb102c4d2994fbf8c053aaa
SSDEEP 12288:4qkqjGl+Sj9kKnc6fhIdQULGb0AjhY4PILsCtk8avK:hSl+6kKc6vaQZpUs
TLSH
T174C4E13C2F936F05E0AD5EF181629C2457F68495C5F2FBA32FE58DE009AC3948D92687
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

شسيشسي

Minor OS version

0

Major OS version

4

Entry point

492598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\KHALED\Desktop\obfuscated\KJ-w0rm V2.0.pdb

KJ-w0rm v2.0.7z

GeoIP.dat

KJ-w0rm V2.0.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

KJ-w0rm v2.0.7z

GeoIP.dat

KJ-w0rm V2.0.exe

mscoree

dotnet