Static task
static1
Behavioral task
behavioral1
Sample
Debug/FastColoredTextBox.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral2
Sample
Debug/Vulkan.exe
Resource
win10v2004-20231023-en
General
-
Target
Archive.zip
-
Size
165KB
-
MD5
64c6708ae16b225aaced6ded623e5864
-
SHA1
88e17582e5aa216822a399b76d92f2a2ae5def3a
-
SHA256
66329c082f6284ec9b3ecf7a14f25d11edd863de29d849e4ede574518c2666a3
-
SHA512
22ea64cacd1d53c9d00d9d0b6ab3a22cbd146bd73295d6a2ad71588efc2b8a1372fa99f2e03d6af8391731015c7f6a67475678c69d90a408e4d98afa54c489e1
-
SSDEEP
3072:Cl5vh/Fo03UfTHkfud4UhVTn3Wvr3FTjulLUeSmzWAb5XzC2OLZu5LoC0yVo:ClH/+H3d4OnyrdulLXzHlmTFVyi
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Debug/FastColoredTextBox.dll unpack001/Debug/Vulkan.exe
Files
-
Archive.zip.zip
-
Debug/FastColoredTextBox.dll.dll windows:4 windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 322KB - Virtual size: 322KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Debug/FastColoredTextBox.xml.xml
-
Debug/Vulkan.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Debug/Vulkan.exe.config.xml
-
Debug/Vulkan.pdb