smb-y16ftv9_[.]zip

General

Target
smb-y16ftv9_.zip
Size 1.3MB
Sample261110-ys84bsds4x
SHA256 3e1c97ea92c8b19c9dc64804a3e91a563a254e84a010774bd0e13388e85e68f5
MD5 e959d8a1f97ca59b1807b09573cbea2c
SHA1 b84f765aa96d75cae9f21eb342ab6cfd14349690
SHA512 6b7eb016b6b42d96aae3000aa76024244a9e8bd61f3ce6a97e5eb164b6f44606cd20d402cdc0ef26e71ab7230a85a9e30efeac6a135da68266cc10ed8d6ef126
SSDEEP 24576:u8/CoB6FIzUmyQzo41h5We5aO22oFWRrCj74pdyGei8sZ9Q3FR:uQhUFI3roKWGaOqFGCj70dydijZSR
TLSH
T19155333D93DF62D86E25DBC402E8C0770DA3A95877DFCE17248C1A7A4E94A4D6A4BC18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/smb-y16ftv9_.bin

File Explorer

smb-y16ftv9_.zip

.zip 1.3MB
smb-y16ftv9_.bin

.exe 1.4MB

smb-y16ftv9_.zip

SHA256 3e1c97ea92c8b19c9dc64804a3e91a563a254e84a010774bd0e13388e85e68f5
MD5 e959d8a1f97ca59b1807b09573cbea2c
SHA1 b84f765aa96d75cae9f21eb342ab6cfd14349690
SHA512 6b7eb016b6b42d96aae3000aa76024244a9e8bd61f3ce6a97e5eb164b6f44606cd20d402cdc0ef26e71ab7230a85a9e30efeac6a135da68266cc10ed8d6ef126
SSDEEP 24576:u8/CoB6FIzUmyQzo41h5We5aO22oFWRrCj74pdyGei8sZ9Q3FR:uQhUFI3roKWGaOqFGCj70dydijZSR
TLSH
T19155333D93DF62D86E25DBC402E8C0770DA3A95877DFCE17248C1A7A4E94A4D6A4BC18
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

smb-y16ftv9_.bin

IMPHASH c80a2354fd8e096ab6fd6b843b9a69f4
SHA256 55fa3d2d0a40bf30c5082f6828b18f290300effb2ea9403bb447ccb2135a9679
MD5 ca3597abb37d955f057f8d7c8d0402d4
SHA1 1ea8af34ec8ab1b10c7ece58ca568d03c199979c
SHA512 44e24139e18dc86a4a251e96e5ae4bc8e8b2d1eaa22249848c553f4f7a68679cf76c31ba9a351d99e0141a7b77ed8c879cf0be8649bf03cb31107bbecd5a1783
SSDEEP 24576:sX1Bc5RFB9He9DYv8V6E6CuBpI0M4WYCjka2igt5EncNU8Q3gakZeOHguQMeNBAm:sX1e5nYu8V6J0kCQi5nEUnTkZesguQMK
TLSH
T10665234BBB6163BDE03205727039537A1EBE9C50F6506A8BE74C4E241E126E98F773C9
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateThread WaitForSingleObject GetCurrentThreadId GetCurrentThread GetTickCount ExitProcess WideCharToMultiByte Sleep GetLocalTime GetProcAddress GetLastError LoadLibraryA GetFileAttributesA CopyFileA CreateDirectoryA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateProcessA MoveFileExA FindResourceA LoadResource LockResource SizeofResource CreateFileA WriteFile CloseHandle MultiByteToWideChar GetModuleFileNameA GetModuleHandleA GetStartupInfoA

advapi32

ControlService StartServiceA DeleteService OpenSCManagerA OpenServiceA CloseServiceHandle StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA ChangeServiceConfig2A SetServiceStatus CryptGenRandom CryptAcquireContextA CreateServiceA

ws2_32

send recv WSAGetLastError ntohs inet_addr inet_ntoa htons socket ioctlsocket connect select WSAStartup closesocket

netapi32

NetUserEnum NetApiBufferFree

mpr

WNetCancelConnection2A WNetAddConnection2A

msvcrt

_except_handler3 __set_app_type __p__fmode __p__commode _controlfp __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _adjust_fdiv _beginthreadex _endthreadex strncpy sprintf rand _exit srand time __CxxFrameHandler printf

Sharing