63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a[.]zip

General

Target
63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip
Size 324KB
Sample261107-wn9g7azzev
SHA256 58d5ebfe7e2beab980e4bc1777b74b4d1e5c40b5772ed66b1bf66cb5a77aa02d
MD5 7e679e7d90c1ef0f9193f33d70449c03
SHA1 ea24fba4853f90536282db0e5cde76469d97b999
SHA512 b0036f3a73097c5a9b2b952e57bf1d81f4d1632d74c7dd443e5b66ac571ccf64bdb527e2817f46956e47656e26429e1be46cddfe02498e6bb8b1555b106f2b2a
SSDEEP 6144:eQqRBp4AKRbjNHDR+Ib6Es1xeAdmj7E+iqL/8ZtE76v+WU4akew:eZpqR+Ib6CAmj79/8QU+G
TLSH
T1C064227509861082D4AE30796438E54D663D46A1AF4B03E8B0B6D0F67A94F4D23FEFF9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

File Explorer

63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip

.zip 324KB
63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

.exe 390KB

63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip

SHA256 58d5ebfe7e2beab980e4bc1777b74b4d1e5c40b5772ed66b1bf66cb5a77aa02d
MD5 7e679e7d90c1ef0f9193f33d70449c03
SHA1 ea24fba4853f90536282db0e5cde76469d97b999
SHA512 b0036f3a73097c5a9b2b952e57bf1d81f4d1632d74c7dd443e5b66ac571ccf64bdb527e2817f46956e47656e26429e1be46cddfe02498e6bb8b1555b106f2b2a
SSDEEP 6144:eQqRBp4AKRbjNHDR+Ib6Es1xeAdmj7E+iqL/8ZtE76v+WU4akew:eZpqR+Ib6CAmj79/8QU+G
TLSH
T1C064227509861082D4AE30796438E54D663D46A1AF4B03E8B0B6D0F67A94F4D23FEFF9
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

IMPHASH ab8fd60b3da01515e6706e8d122c633f
SHA256 63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a
MD5 5b7e6e352bacc93f7b80bc968b6ea493
SHA1 e686139d5ed8528117ba6ca68fe415e4fb02f2be
SHA512 9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6
SSDEEP 12288:ef/X4NTS/x9jNG+w+9OqFoK323qdQYKU3:EXATS/x9jNg+95vdQa
TLSH
T1B284026131D38172F0F38A3419DAF6674FBEB452877091CECB5A561A2D31781AB383A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

4747

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\PC\documents\visual studio 2010\Projects\NotPetya\Release\NotPetya.pdb

63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip

63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

kernel32

shell32

generic

Sharing

General

Malware Config

Signatures

File Explorer

63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip

63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

kernel32

shell32

generic