26340314499.zip
- SHA256 0db7d3322d25158dbd691f88fbf6be3781c1763268f2edfa639b7d08813f24d3
Password
infected
Static task
static1
1 signatures
General
- Target 26340314499.zip
- Size 47KB
- Sample261014-ckb8qset9x
- SHA256 0db7d3322d25158dbd691f88fbf6be3781c1763268f2edfa639b7d08813f24d3
- MD5 d4e0a7e912013ceb796453e60c03723f
- SHA1 28c54f8f3502d3640f5fc306feba6f2b2adda738
- SHA512 4fdeda604dea9f9be55a6971cab4571740a7987c7dbc786c42b8a384d68a01e5dfe6f3fbdb6dd2ada7b91e2ae365c8ec539856f2e88c1718cea0ed991234e91c
- SSDEEP 768:rTRBHN+XZ/L8KiXig5KM9/813+8fM8UXPd2AN3u4273ylhJnfLHNzXs0zXGT9ky:rT/N+XZ/lY5KM9/pB8U8AN3u42obzHNw
- TLSH T16A23F1928B1EE5D0D4E6247FD778E48C0AA44B61E8F6360DADDE598C49DC739C33C126
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bde86f394c09ababdf70fa0dcb5ba0a2d4864ea6ba102da73e0837b24fe75563
File Explorer
-
26340314499.zip.zip 47KB
-
bde86f394c09ababdf70fa0dcb5ba0a2d4864ea6ba102da73e0837b24fe75563.exe 82KB
bde86f394c09ababdf70fa0dcb5ba0a2d4864ea6ba102da73e0837b24fe75563
- IMPHASH e144f72a80271b9e68ff431f58466808
- SHA256 bde86f394c09ababdf70fa0dcb5ba0a2d4864ea6ba102da73e0837b24fe75563
- MD5 728b6008e1238f632ef06a4a1eb3cad0
- SHA1 7b29d9f3af1a3fb1ed5baa3ae5bcc81ab34533bc
- SHA512 12df31158898d9db05a61bd3d51f9ddd4d8633a037c522af4f4892546c6201a6a13205dfbd19e2d1e7bab3475e268f574b30bb882effae29d2836ed6b1295b91
- SSDEEP 1536:oaST/U0NeRJOqnNcAcBxLORqB0vSkLrtJ+ugaFmQAk2SrofNRsW+HcdlrreCGsnF:opMxEMNcAcBx6SkLruu5Ak231llrreCP
- TLSH T175835A52B5D184B1E676193258B8DAB18E3EFD200F619EAB3348067F0F742D0DE25D6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4891
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\SH_FCS_TODOP-261001\trunk\StartBat\Start_bat\Start_bat\Release\Start_bat.pdb
kernel32
ExpandEnvironmentStringsW
GetEnvironmentVariableW
WriteConsoleW
CloseHandle
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
DecodePointer
user32
wsprintfW
shell32
ShellExecuteW
Name
.text
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=142, id=261, version=30795,
count=20, id=260, version=30795,
count=20, id=259, version=33808,
count=18, id=260, version=33808,
count=38, id=261, version=33808,
count=7, id=257, version=30795,
count=85, id=1, productName=Unmarked objects,
count=1, id=265, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,