4b8d01d7080b.rar
- SHA256 739361a45bd1af852a945d5df4debdb641d7c1f3de551550e54dc756c55575ae
Static task
static1
1 signatures
General
- Target 4b8d01d7080b.rar
- Size 94KB
- Sample261024-a4fddswt2l
- SHA256 739361a45bd1af852a945d5df4debdb641d7c1f3de551550e54dc756c55575ae
- MD5 e28c1623920908a3b43b9a3bf5054b8e
- SHA1 e636bebc2e6bd90b0d0631bbaea6ea6ca18697a6
- SHA512 9bf2b591963a1c30e1df300f075272df380bb90d8e702a21144691e7af157e9025a9f58d9798af9924b985ce49fd13c1fd5f7d2a31a1052fdf1148c474ecfb33
- SSDEEP 1536:zB2p2LDvF4dmVvvneeWI1GXj2tW9Srakpx/Xkpl4Zyy3rhJ6USRfOhTH:E0LTVHenI0X6djYl63rpSVyTH
- TLSH T1E593122D012890D9458BDF59F64DC82CE53DE3659CD394A1F6ACDC7B7234E2C1AB083A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4b8d01d7080b.exe
File Explorer
-
4b8d01d7080b.rar.rar 94KB
-
4b8d01d7080b.exe.exe 175KB
4b8d01d7080b.exe
- IMPHASH 4e43820bf8be02a1c0d1ab60f1c075b0
- SHA256 be70991efe0351b9ae0db0e955943e941c01a8a4a4dba575bff664ce222b30ec
- MD5 7f339462072710b7e8937005957edfb7
- SHA1 cfd284904b5cf4ccd24fc03eadc1eb123bd19f3e
- SHA512 820261f342148dd77834f1580f9b8adc6477a8507194a7a8493bdfd078cf9f808eb35b670f06d376e8202ef0d2f42596a7f407c6a81f4f30643888a1c6f91e32
- SSDEEP 3072:k1VN+nsNT4MVhGqFYqVq2VpVwbIwmT2EBY3VzdOR1Ju:k1SsNkShFVZlw8T4Vxso
- TLSH T115048C6B72A170E8E06A8239C8960705F3F1BC7547A19BAF036446755F33AF1DE78B21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11148
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
HeapAlloc
GetProcessHeap
CreateProcessW
WriteConsoleW
Process32FirstW
Process32NextW
GetLastError
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetFileAttributesW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
CreateFileW
TerminateProcess
WriteFile
GetCurrentProcess
HeapFree
CreateDirectoryW
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlUnwind
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
advapi32
ImpersonateLoggedOnUser
OpenProcessToken
RevertToSelf
AdjustTokenPrivileges
LookupPrivilegeValueW
DuplicateTokenEx
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
crypt32
CertAddCertificateContextToStore
CertCloseStore
CertFreeCertificateContext
CertOpenStore
CertCreateCertificateContext
Name
.text
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=31935,
count=9, id=259, version=31935,
count=1, id=262, version=33145,
count=48, id=261, version=31935,
count=11, id=257, version=33145,
count=123, id=1, productName=Unmarked objects,
count=1, id=265, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,