Protector.rar
- SHA256 2af1d010ca097be84bf92377923d6aabae9ca0e5a0d7b3b0218ad818213cfae2
General
- Target Protector.rar
- Size 1.8MB
- Sample261025-v3f9hsxt3k
- SHA256 2af1d010ca097be84bf92377923d6aabae9ca0e5a0d7b3b0218ad818213cfae2
- MD5 22ee015c9dca7215c33a7df247a69d2c
- SHA1 aaf884ef7beee93b0c984815452d13c3d3c54d4c
- SHA512 05da1c24792788afb55d023b072e85051e8383c8f4b67852b40c77169f743b4935632dbbe9713f3e6afb4a751f9b5df9ef1dc030dc17da2f4db15754c1f48227
- SSDEEP 49152:1VxcfYunhvBqVj8nL3KcwTPLKjNl44uE1Cj:1VxYhQLDKjDpgj
- TLSH T1B29533D20154EDF1D01FF63CB73BC264AE174B74BDDC407408AFAE66122E1E52B92A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/Protector/DrakeUI.Framework.dll unpack001/Protector/M4R7H - Protector.exe unpack001/Protector/M4R7H - Protector_temp.exe unpack001/Protector/dnlib.dll unpack001/Protector/x.exe
File Explorer
-
Protector.rar.rar 1.8MB
-
Protector/DrakeUI.Framework.dll.dll 1.6MB
-
Protector/M4R7H - Protector.exe.exe 184KB
-
Protector/M4R7H - Protector_temp.exe.exe 196KB
-
Protector/dnlib.dll.dll 1.1MB
-
Protector/dnlib.xml.xml 1.8MB
-
Protector/x.exe.exe 208KB
Protector/DrakeUI.Framework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 70e72477f7fe0018e043ce8fe2228a289459058ee41caecd6f05855898bc5b80
- MD5 0562b4c97f643306df491a938ae636da
- SHA1 0807c37b711374ed4814a9518c9e264517de89a0
- SHA512 c969cd274b6bf65a34f1d129b6531616a3485a1f153088609ad2369d380fdec37c3e88a423495912715a26e353dd5498f7f9e73c895e9f3f18fc7d1e65d2ecaf
- SSDEEP 24576:nYyUyUxws47SDJ+wfa3ZsacYwzhmT5LOMobxqFFnM9Pv1w+Fus:nYyUyUueD001YwzhmVSMoNqFF
- TLSH T1D085AE4527A88E1EE57E87FED4321420D7B49601B1DEE74FEEC1B4E92CA77888C09587
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1710290
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\DrakeUI.Framework\DrakeUI.Framework\DrakeUI.Framework\obj\Release\DrakeUI.Framework.pdb
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Protector/M4R7H - Protector.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 046da67ebaf00506e3850a76081d66b548178ade86051220799198ee1dce01d8
- MD5 b3b0123dbb0ef33e0bd372e855f56202
- SHA1 c126b26cb4002f8612885a3e73fbe723c4191bc1
- SHA512 92d21dd8222542c22e181b897f8bbf67aecf974b8ed0534065dd3aa43f1bd2d8f961a6926e78f7034c2906525bc9125fdf6de8bef2554537ff2e22b477c2d93e
- SSDEEP 3072:6HhZVC3kWJbgdS9F5xXYexmKt0dNyAtoi7xWz9yJMOaI5qFY+XJBQa:shbCVKdSpxXlxmKWHz9x9b75qFYe7Q
- TLSH T11C04E00333D88D23C97B02FA4861A7E053B0511A10A6E7DA9EF69D8BF5DDBD50E006DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
189454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Protector/M4R7H - Protector_temp.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 87d883d68a2586a7ae38af2a85d9a5168c8a21ae215bdd60fe11d89208acfdc4
- MD5 a2969f2e7d20222ea2b5b6e0cf836fec
- SHA1 69f545b9e060202aa11227b75ef508bc2ef556fe
- SHA512 450f5c4224e5975adad3d18f7364dfd702e0e7d251bece9e1c94665e16dedbd37d0ae5427bf1b0a37c1dac5f4a2e3f669e1b55a93a465e338c9dde2a5105f151
- SSDEEP 6144:L4bCVKdSpxXlxmKWHz9x9b75qFYeOEmj:dZXlxqHzP9x8
- TLSH T16014D00333E48D22C9BB01FA5861A7E407B0620A5066FB9A9EF59C8FF5DA7D50E017D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
189518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
177KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
Protector/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 884b4fb8574cd2b0356304e3e7006d492f9aabf53e096e7e061cd164ddc64248
- MD5 d7b7e3c6466f2eac201bb3a09b1a885f
- SHA1 9fafdf91b58bd6cb2f39f1ad58f3ea9c43d27aba
- SHA512 cfa9a74950152c4ce09b7b5e19f20f7666fb109bc4b12a7f0244435771aa912fe7dcb7e48c2846c62e136951113d5e1eb33593139aa4e0fab0f80c9d1758cc89
- SSDEEP 24576:6ipq7WFu3kPQG8X7XGcmEbpQdeCBv7fR6h4hg:rUGMmEWT
- TLSH T139356C0537EC9B77D09E877AD4360A1847F2D805B397FB0F6610AAA95C87794CD02BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1162954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\dnlib\dnlib\src\obj\Release\net45\dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Protector/dnlib.xml
- SHA256 8b13ec4e9d841ded26a2f7aa515d9927ae3ae94ecbac8d914c660baf86ce3898
- MD5 ac3741845c0acc8cb72f1cf4fc634c7c
- SHA1 a36f1e398bb80f6c16308dd7581805c8fe411b68
- SHA512 f5bc73192aeb48234c78e5c4493745b475a3075ac9f7bad52b96bbbece443a9e1400d00592f7a1e552aca7db8a90fbb20e11f50a2bc47ab0dacb6e7b63cd71d4
- SSDEEP 6144:V+N+Hpv2E8BGrOuk+XhR+y+cNUaOtCndn:Ppv2E8BGrOQXhR+y+cNUaOtCndn
- TLSH T191857714B6C2AD121C36525B9E64FCC4FE550C33604A2E19B68D2F535F7ADCBE2AF920
- MD5 SHA1 SHA512 SSDEEP TLSH
Protector/x.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b27b11ec5e92931c0cb8dfdd5dc63df28a73e2363e640acc1a59607152e1cf11
- MD5 843d752505a8937f02c4ac8bf22f82a7
- SHA1 84c53947c4b83ef157db0ca8d70741edce24b7c3
- SHA512 2e0e10be0da65d62deba3e42260c70cb8751dc241f13999fd6529e17a3206b24549b677ceeae6015b42a085e413f5723063e9277631e2d27857859848b51a9a7
- SSDEEP 3072:XHhZVC3kWJbgdS9F5xXYexmKt0dNyAtoi7xWz9yJMOaI5qFY+XJO58qnEZZEY3:3hbCVKdSpxXlxmKWHz9x9b75qFYefZ1
- TLSH T1F624D04333E48D22C5BE06F548A293A043B4A25B4466E7DF5DF698CBF5DA7D40E00AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
214574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
202KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ