yes.7z
- SHA256 1e244e5266c6679ed0f1ce94195bdbac9071fb34a41962fea9dad7cb603a3bf3
Static task
static1
1 signatures
General
- Target yes.7z
- Size 88KB
- Sample261017-j7p7facv8x
- SHA256 1e244e5266c6679ed0f1ce94195bdbac9071fb34a41962fea9dad7cb603a3bf3
- MD5 efb6b000cc61abd7703360e6cc811092
- SHA1 b26d3f921fccace4748c02ca7b79fa140e2ffd71
- SHA512 8660d5c37423ba176e462fcccac5ed87c81a7409af0edcc948b61780582fddc9d399d0e2cdc0e98d2a4e9c501f6a28e71abac0978b8b096aecccd4267685fa9b
- SSDEEP 1536:2WIKRPBMltXn59cZfYLR6B+shJt2GWdlMYU2TVVFSEK7zfomp28q/wvTtHeg+pRt:LJCltXnb+w8B+shJQGWdGj8VFSLzfob1
- TLSH T1C69312AD084EAB2AA69D2F9225C0B324C50DDDFF2656C366F5215838F27551FDD3B013
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/inject_local.exe
File Explorer
-
yes.7z.7z 88KB
-
inject_local.exe.exe 129KB
-
loader.bin42KB
inject_local.exe
- IMPHASH 3d8d93f6515715be7cd7ce6b863389af
- SHA256 65ec73a667857b2a9deffce1011b262d7062c8343f27fa31c37be455c86c7c68
- MD5 7a9ae31175f3e02563e0720f19d4d0d5
- SHA1 7d1c38da2e02c415c7890a46d0136a5c067e6b72
- SHA512 da9561de40d5fca28934392fe5210d11c49a8724e3619fa631e6691903a34fef31def7a34ce210aa48503f5e0432a8cb497e100e6f9f7b7317ea8fdd64163b30
- SSDEEP 1536:4exczEk1Sc+lEAIMa9D42Jd2ygO5veeS3vZldjvI/qkBsWzd7B9dl1YPRhT:7MWZdMD42QygguBldjv4r9V3Yp1
- TLSH T166D38D57B3A130F9E5B68239C8611A45E772B8361730DBAF03A447662F272D19D3EF60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6032
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CreateFileA
GetFileSize
ReadFile
CloseHandle
GetLastError
VirtualAlloc
VirtualProtect
LocalFree
FormatMessageA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CreateFileW
RtlUnwind
Name
.text
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=7, id=259, version=27412,
count=139, id=261, version=27412,
count=3, id=257, version=27412,
count=90, id=1, productName=Unmarked objects,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=38, id=261, version=35207,
count=1, id=260, version=35219,
count=1, id=258, version=35219,
loader.bin
- SHA256 95c108bc0864e43929efb6ae63666b81e9a28325cd94f4406b7508b73b7b038b
- MD5 c1201939a281a349ba0b6f0e05b0b6d4
- SHA1 8130598d20d4147e4fffa0aa873f78d6a46e7899
- SHA512 dcebbd45135415b20fbc8e9e4de06f0c5e402b88a36e86750c19522ea773ddafe7fd73512fd1bef107a0cbab6e812c778f05ab61fe15f2d72af983f0c1522d84
- SSDEEP 768:dRnK6U9vY3mJ4ilcgeMZcCfPYyRI6gv7R6SVvqte4/we1aG48zVNKp9dY+8GLC6:d569vYTilcge+ZjdUy14eL4eVNKWU
- TLSH T14A13AFB1F7B241D4E2618034FD55AA2FEEF1789940186ACF63498A4A2B33E307E5D35C
- MD5 SHA1 SHA512 SSDEEP TLSH