3 Samples.zip
- SHA256 491e63fea39b517d4df12234f035951db8f6b6dcfc42d117270fce64193dc040
Behavioral task
behavioral1
Sample
3 Samples.zip
Resource
win10v2004-20231023-en
windows10-2004-x64
0 signatures
1800 seconds
Behavioral task
behavioral2
Sample
ca.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral3
Sample
client.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
0 signatures
1800 seconds
General
- Target 3 Samples.zip
- Size 8.6MB
- Sample231027-sw5bnafc71
- SHA256 491e63fea39b517d4df12234f035951db8f6b6dcfc42d117270fce64193dc040
- MD5 663870a254e643bbe8acf7413b4fd386
- SHA1 5792d653003978a6c87d4c10ef6738f0fa07b8c6
- SHA512 58188d17331aa8c5177b6e524bc5a8cf301c51762eaf1c65471463c7acc431c5c41b3cc6cdbd13c96a812071e6cba67ff71129d1ce2aa54789f432fbae34c42b
- SSDEEP 196608:94lb5vuCfa3nz0F9rJ+qtRYDYgHB7Vo/+E1BDcDNI2oJz3M/tcf7YNqKK/P:94l1nfaXz+9Fb7oBWGwBADOxAcfT/3
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/laplas03.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/ca.exe unpack001/client.exe unpack001/laplas03.exe
File Explorer
-
3 Samples.zip.zip 8.6MB
-
__MACOSX/._ca.exe229B
-
__MACOSX/._client.exe229B
-
__MACOSX/._laplas03.exe229B
-
ca.exe.exe 485KB
-
client.exe.exe 7.2MB
-
laplas03.exe.exe 4.3MB
__MACOSX/._ca.exe
- SHA256 533f97d80bdce93013ccacc7739d48d24d48eac5211070d4c671f92dd4dd35e8
- MD5 36fb0db8fe20ee8b14211ca84806629e
- SHA1 9c6029786d76d79acd16b9b4359d56df0225a752
- SHA512 28a9c35ae318b1bcd437765ff7752661c59269e6dbd2fb2194638110d7fc1a9af186413b01d3f3ce35aea1442c078cf46b6af50db73fad3e32e1ceb8891761d0
- MD5 SHA1 SHA512
__MACOSX/._client.exe
- SHA256 7242902feb082df13fd7ac696d66fe6bb3767e455dae98e4096d9317275406b9
- MD5 a868437e7494128847d1893db1451708
- SHA1 0222501746d6efd49680a1e6c5f94142f32a267e
- SHA512 c9812df83a1ac91b6a10c9f5025e3f4709c7486c778b41ddbf0f60bf98fbf3fca0c8007ad8e61e81e869532c9c37d7d85a36b4aab64389031c2bd41f7ba4d094
- MD5 SHA1 SHA512
__MACOSX/._laplas03.exe
- SHA256 6799eaec6f1475c1b17237fae6ef6eb19affd388518e2542863151903a44bc0e
- MD5 c2b46f775cfad3626291264fbfeedfd1
- SHA1 91056b1b758c49f876545cfc4562d417fbaf4762
- SHA512 e87f4e20b043c9c05727601387cca2aec638dc17845a0f64458a50d3e111d336a8819fd4f68da63326f2f033c6d6d8dbf173db583023f0934885e017e244ba38
- MD5 SHA1 SHA512
ca.exe
- IMPHASH e9fd10d97cf20222ca5adc3f78cc7aa1
- SHA256 f9932b364f52c6fe0191e34ddcba772df8460bf579f422cabd93ca192bb3e1a6
- MD5 f006571dc0238d9d9cf22d6612aab5ed
- SHA1 7e18ee447d59cb7983ada15bbc9631dbd6c70fdc
- SHA512 ff04c4cecb59c4f4d70148632090fdbcfa3865631de2bab9b65a7c642a42cf60979e559c0155deabc05e56ee8c754a3004c6bd69e580d4058a525d725aabc7d1
- SSDEEP 6144:kC003m7vq8QHH7yqG8BX/3bnSROFiFDKB6enUKKKKKKKKKKKKKKKKKFAIAOUtBDI:B0wmzqbeqTTSMirPSZYT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
42528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WaitForSingleObject
Sleep
CreateThread
lstrlenW
VirtualProtect
GetProcAddress
LoadLibraryA
VirtualAlloc
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetCPInfo
LCMapStringA
LCMapStringW
HeapCreate
VirtualFree
HeapReAlloc
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
CloseHandle
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
CreateFileA
Name
.text
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.qrzav
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
347KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=22, id=149, productName=VS2008 build 21022, version=21022,
count=53, id=132, productName=VS2008 build 21022, version=21022,
count=133, id=131, productName=VS2008 build 21022, version=21022,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=92, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
client.exe
- IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
- SHA256 e65a897de99384a667679ca3becc9b2258b9391418a06471517b8a58ae863d99
- MD5 8a91f3743fe18864ce449301ba6c7cfd
- SHA1 f46c555796025fce2ee3a24d23bdbe3455f44fdb
- SHA512 3ac193b27b71a951145a2aa55c58206a49159651ca0edddcbb52df2619cf1bee8ba6f4a0aa3a9cbe904bd90206e3e335d6fa35bb5252e73dba80fd52fff6a736
- SSDEEP 98304:f3BYZrNCEwfTXMStYZ6aHskFiJLuj9m84MBfBn:/irNPwTMStOdHvwLp891
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
419584
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
238KB
Virtual Size
623KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/4
Size
512B
Virtual Size
295B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
400KB
Virtual Size
400KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
811KB
Virtual Size
811KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
545KB
Virtual Size
545KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
353KB
Virtual Size
352KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
laplas03.exe
- SHA256 a0755055fec6800ed05b9f1c5c1a997a279a6b992a0eca4b0dc3789120ac4ad3
- MD5 14817abceacc2869286157bc5198ba30
- SHA1 8d280a5abede4d4cfb2017ace6b172c69771d470
- SHA512 190825317c17477ea511f86f85476fa860728a1379e256415b6414b0fa43137322bcbbb37dd63ed4f67614efebbfd90667fc26d853bd92c3cd254405b637bec9
- SSDEEP 98304:fVHtTKu7hiVzlYtbdmkrfKiu6vFAtgslXW9/Mp2dH+0EXy:fJxEVzQgkrfVuTtgD/Mp2A09
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
15055568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
10.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE