South.zip
- SHA256 cb66a80bd6e725dafb60fc8443180121248d30804ef01cbe858cbc988a827c9f
Static task
static1
1 signatures
General
- Target South.zip
- Size 18.3MB
- Sample261012-2gzbjafa37
- SHA256 cb66a80bd6e725dafb60fc8443180121248d30804ef01cbe858cbc988a827c9f
- MD5 485df5b85a708317f322569d5434784c
- SHA1 99d210381739ab0a3fbc531aa4acfa1d5d181531
- SHA512 02c7f602ce8ecbd7a53dd7342175bf0b6c95e11651dffc6357b4eb8c78f5a418217556fe98e42b47c590e690319ec3b0b48436954cb8748295737d6a478d90f4
- SSDEEP 393216:BCD+zbIUhwQv/tXwXSRYIafb07yRzxairhWy:oD+QtetwZDfbDRzxyy
- TLSH T16A1733BD87C0C5E907E612679040E57BE8EC6CDC8BE1EBA89F99CA574CED8D00C09765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/loader.exe
File Explorer
-
South.zip.zip 18.3MB
-
.config36B
-
loader.exe.exe 20.1MB
.config
- SHA256 67dbc1f7bff67f7d33771232ef68d496420e6ddb44de9b2670dca22550f1eafd
- MD5 07ecc6318aa229a9c16696af915109b8
- SHA1 e3bc31223d65e3af7a01590393bac5690809d556
- SHA512 9cca109b9f037749c21d483752aadcb414beb8beb2c5710b7256745ffd21134107e75e7e223a0639d6509c5a3cca34c2c9b98a64951875c8658d4b40b131e3c5
- MD5 SHA1 SHA512
loader.exe
- IMPHASH cf125eacfe25296a43ff37467c728d88
- SHA256 620890674d5fd3607e26f034b1d4a020956fe1902cb80824293ee4a49f344e0c
- MD5 8e54a8042b791d5f01cf529f0054c735
- SHA1 3109b69ff6fca35c6649849a7b9202ed7958f809
- SHA512 f96274111693e661e00f2cde795babd4db9ca9a4827fbe9dd530d1df83d8add14bea4fdc193764b6168d71f74058a37c8b34bd2ccd8accc11d77e3aa949728fe
- SSDEEP 393216:ywbZdiw0459I+BU61NfNE74bQGn18C0QpG8:1bZdS4c10lEXGn18C0QpG8
- TLSH T1662723D7C6C44BF48793854DA09B03CFF1C0A59AD7EA5E0D3A865C0236A0E5A474BFB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
16009231
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetTimeZoneInformation
user32
GetWindowRect
advapi32
CloseServiceHandle
shell32
ShellExecuteW
ole32
CoInitializeEx
oleaut32
SysAllocString
userenv
UnloadUserProfile
gdiplus
GdipAlloc
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlVirtualUnwind
setupapi
SetupDiGetDeviceRegistryPropertyW
d3d11
D3D11CreateDeviceAndSwapChain
bcrypt
BCryptGenRandom
secur32
InitSecurityInterfaceW
iphlpapi
if_nametoindex
ws2_32
WSAEventSelect
crypt32
CertFreeCertificateChain
Name
.text
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
389KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.3P+
Size
Virtual Size
12.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.)d<
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.t;-
Size
20.1MB
Virtual Size
20.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ