1e8d9f532c2c5909ba3a8ec8d05fc8bed667dcc0c2592224827b614af7fa3ce1.7z
- SHA256 49bd6a66feef5907c62a7ed4ec9a7ea703f318361f97d490d16c190e2d7b40a9
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e8d9f532c2c5909ba3a8ec8d05fc8bed667dcc0c2592224827b614af7fa3ce1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 1e8d9f532c2c5909ba3a8ec8d05fc8bed667dcc0c2592224827b614af7fa3ce1.7z
- Size 186KB
- Sample261020-vm1m8af18m
- SHA256 49bd6a66feef5907c62a7ed4ec9a7ea703f318361f97d490d16c190e2d7b40a9
- MD5 cd3f64d541740b2e1b7320477e093909
- SHA1 8414f96df8c2a3cefa30193ea13addff102b8639
- SHA512 be21022a91b4dac7ec841a6283e539f0c5aa8a72bc12210416531bcfcdd48b81ac569096a4b258088117c1b0de4840f493cb88f6b514679c14159d03c14b23e4
- SSDEEP 3072:4Zb2Qk3NfjPi5MDYTf2+cyetRDw4XF7PDkb3ZOckmIkp6IQsERadTMpt:4ZiQk9b6iDSfcxHP6b3tIW6dAit
- TLSH T18314233AD7BCD66BD56F71BF8B963232C43F3E56C4318499120E4A54F9DA8C23272192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1e8d9f532c2c5909ba3a8ec8d05fc8bed667dcc0c2592224827b614af7fa3ce1
File Explorer
-
1e8d9f532c2c5909ba3a8ec8d05fc8bed667dcc0c2592224827b614af7fa3ce1.7z.7z 186KB
-
1e8d9f532c2c5909ba3a8ec8d05fc8bed667dcc0c2592224827b614af7fa3ce1.dll 338KB
1e8d9f532c2c5909ba3a8ec8d05fc8bed667dcc0c2592224827b614af7fa3ce1
- IMPHASH 355388815c4c74c01abe63e4cc515b68
- SHA256 1e8d9f532c2c5909ba3a8ec8d05fc8bed667dcc0c2592224827b614af7fa3ce1
- MD5 bbf0eff9215c72cb8396cbb3bcfd4f50
- SHA1 d875bfdf409ae80bcedf398dc9a54482c4e99e8d
- SHA512 d473db85e0d77a63c3e89d7b14a9a151aa7cdba1bafd6dfaee58fa385c86a807b0cfe7c06dbd489d9c7de69d1ce7b7b3de64c66512085f064a48ec519761e6f2
- SSDEEP 6144:huOhdwviVCGFOTgYip1hK/8DRsOtDePtSv6+N2fvP8Pbnni6ikY1Gyz:huOhaKVCGsOAP4p2fvEPbni6id4S
- TLSH T11174BF06766C50F9E8739138D8932B26E672BC5B4339A36F4B204B705F6BBC06D3A751
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Infected
Minor OS version
2
Major OS version
5
Entry point
66024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapReAlloc
FlushFileBuffers
GetVersionExA
FormatMessageA
LocalFree
GetCurrentProcess
CloseHandle
VirtualAlloc
GetLastError
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapFree
HeapAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetLocaleInfoW
FlsGetValue
FlsFree
SetLastError
GetCurrentThread
FlsAlloc
RtlUnwindEx
CreateFileW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
Sleep
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
WriteConsoleW
GetStringTypeW
SetFilePointer
GetConsoleCP
SetStdHandle
user32
MessageBoxA
advapi32
SetSecurityDescriptorOwner
LookupAccountNameA
IsValidSid
CopySid
OpenProcessToken
GetTokenInformation
LsaAddAccountRights
LsaStorePrivateData
LsaOpenPolicy
LsaNtStatusToWinError
AddAce
GetAce
GetAclInformation
AddAccessDeniedAce
InitializeAcl
GetLengthSid
AddAccessAllowedAce
DeleteAce
EqualSid
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
LookupAccountSidA
FreeSid
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetSecurityDescriptorDacl
MakeAbsoluteSD
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorLength
RegCreateKeyExA
MakeSelfRelativeSD
LsaFreeMemory
LsaClose
LsaRetrievePrivateData
ole32
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
DllRegisterServer
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=87, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=158, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=127, id=1, productName=Unmarked objects,
count=33, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,