General

  • Target

    windows.zip

  • Size

    44.5MB

  • MD5

    3fd5f3cdb0bb68ae12773c56b328321a

  • SHA1

    ab2bde86d5746b39ab6bff4c3ef488006021ca5c

  • SHA256

    42a3661db277bcfaebe49687dca88714049e24a7d39826af562236e323c449f7

  • SHA512

    db354458a2faa5eb4c6eddf7ec0ab4d4cfea0cf0ebe7e48f3c2f79a5f86376289ff7a0d88452a58fc1fdee664d6e5d4a3d896c7a38a8eab0b7257ee114e2813b

  • SSDEEP

    786432:oRJtPRexoO42WUj59jdp/VMgNeAvRRP8Yr+kcg2wl4F0/nMUNmTf5o8Tu52D6Z2V:ZB43eXRp/VMEeYb/+kv2wVpmTf9Wn14X

Score
9/10

Malware Config

Signatures

  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • windows.zip
    .zip
  • Scarab.exe
    .exe windows x64

    5fd9536cd15200695d07ceae818f2be8


    Headers

    Imports

    Exports

    Sections

  • Scarab.pdb
  • av_libglesv2.dll
    .dll windows x64

    1dac4bcc7f887f5e7dbadabe4ccef676


    Headers

    Imports

    Exports

    Sections

  • libHarfBuzzSharp.dll
    .dll windows x64

    24746f1e7a3f00835993ed8d16f1ef5f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libSkiaSharp.dll
    .dll windows x64

    ffe661c0b06e35c1f2a6559c922e2926


    Code Sign

    Headers

    Imports

    Exports

    Sections