happ_windows[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
happ_windows.rar
Size 7.1MB
Sample261110-peeswsav3w
SHA256 296ab7bd65892e3fc6d48ad52e55f3a57825a92d591b77f7a9924f73a316dbbc
MD5 850ffa72e08cf8950e6446b6b262c87a
SHA1 34a099ab86d9ffeac04107ff9f18482f0f3d7d63
SHA512 63516e2cb0a3eb30dd2e0366d30c5dda176849ad3c86be564d09aaaba90fc0e8e670449de3263d880bde1c47c593dc239e98f6e95527ecc5cbc1ffe70dd1ff40
SSDEEP 98304:1SOZOjnBsdwJk26Lx0MrRZiLsPJNmgU5Gh0nQ3TCjngpkTsGoxCiUKonWusXP0bz:rGnmwinREsPbmgwH6LcZKonWD0bNW2Qo
TLSH
T18C7633857273D3E64F3171CD668BC7C12C867A0A7B58B9F9C414428AE9C6FCC0B6698D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/happ_windows.exe

File Explorer

happ_windows.rar

.rar 7.1MB
happ_windows.exe

.exe 11.2MB

happ_windows.rar

SHA256 296ab7bd65892e3fc6d48ad52e55f3a57825a92d591b77f7a9924f73a316dbbc
MD5 850ffa72e08cf8950e6446b6b262c87a
SHA1 34a099ab86d9ffeac04107ff9f18482f0f3d7d63
SHA512 63516e2cb0a3eb30dd2e0366d30c5dda176849ad3c86be564d09aaaba90fc0e8e670449de3263d880bde1c47c593dc239e98f6e95527ecc5cbc1ffe70dd1ff40
SSDEEP 98304:1SOZOjnBsdwJk26Lx0MrRZiLsPJNmgU5Gh0nQ3TCjngpkTsGoxCiUKonWusXP0bz:rGnmwinREsPbmgwH6LcZKonWD0bNW2Qo
TLSH
T18C7633857273D3E64F3171CD668BC7C12C867A0A7B58B9F9C414428AE9C6FCC0B6698D
MD5 SHA1 SHA512 SSDEEP TLSH

happ_windows.exe

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 74091f5ffd3dd7ab389661d1879a58b8681aca001a53ac3ab51e431eae5e2f48
MD5 586225e0a383082261ad659cdfc7b523
SHA1 afb6b1d80c5c49128d1a55369ebe55db642d2d9b
SHA512 20a32f2bc3559d13ce4bd1edacb98f950e825bfccb19dd18aa2df6079a32c680dca0dd10f7d5ceeb2f3fc9790dd5ac461ef032e1e0fdc77fc52e5252afce8153
SSDEEP 196608:ScWObGNvYbh5aYDw9bp5SXS7k96mtbsXUOJNOVtcwR:SI6NA95h0CS7nEsXHsVRR
TLSH
T105C6CF03EC5559E9C1AED2318A729263BB717C884B3163D32B50F2392F76BD0AD79358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

549792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.2MB

Virtual Size

37.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

happ_windows.rar

happ_windows.exe

kernel32

generic