Ursa Major[.]harmless[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Ursa Major.harmless.exe
Size 103KB
Sample261027-vja86aeb24
SHA256 455812c6a35a99ac4cb753b48aa032c56e494420df71126c0ab25d5bfd831414
MD5 4f6eb1a44bcc7a46f325b787225c22f0
SHA1 692bfd963debd0bb3d57027dbac3c6d13d166b24
SHA512 1d8cb6a4ccb55d9450e49b90d0ae8bbb4272d0b2342bf08eb2d707fdc2e706267b4ca910f20a0642eff8896ee0ff2e3289de57691ca648ea00c431011e54c1f3
SSDEEP 3072:X70oM2GyFycS0nb59Oxj12MDf+YN7qskZ31:X70oMHcz5AbJqt31
TLSH
T131A34B01B5D084B2EA762B311C70EBA14A3DF9711F658EAF3394157A4F341C18E36EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ursa Major.harmless.exe

File Explorer

Ursa Major.harmless.exe

.exe 103KB

Ursa Major.harmless.exe

IMPHASH 58878eae069e6161aaf5c9e3da9a1f1c
SHA256 455812c6a35a99ac4cb753b48aa032c56e494420df71126c0ab25d5bfd831414
MD5 4f6eb1a44bcc7a46f325b787225c22f0
SHA1 692bfd963debd0bb3d57027dbac3c6d13d166b24
SHA512 1d8cb6a4ccb55d9450e49b90d0ae8bbb4272d0b2342bf08eb2d707fdc2e706267b4ca910f20a0642eff8896ee0ff2e3289de57691ca648ea00c431011e54c1f3
SSDEEP 3072:X70oM2GyFycS0nb59Oxj12MDf+YN7qskZ31:X70oMHcz5AbJqt31
TLSH
T131A34B01B5D084B2EA762B311C70EBA14A3DF9711F658EAF3394157A4F341C18E36EAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13221

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Senad\source\repos\Ursa Major\Release\Ursa Major.pdb

kernel32

HeapSize HeapReAlloc GetProcessHeap GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW WriteConsoleW GetTickCount ExitProcess CreateThread CloseHandle TerminateThread Sleep GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW GetModuleHandleExW LCMapStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA DecodePointer

user32

GetSystemMetrics GetCursorPos ReleaseDC SetCursorPos GetDesktopWindow GetWindowRect GetDC DrawIconEx FillRect MessageBoxW DrawIcon LoadIconW

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection CreateCompatibleDC StretchBlt PlgBlt GetStockObject CreateRectRgn DeleteDC Rectangle SelectClipRgn Ellipse DeleteObject CreateSolidBrush

winmm

waveOutPrepareHeader waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite

msimg32

AlphaBlend