46fa7795f8434ea22ff2d18f9a4ded29
- SHA256 52d95f79b909e1773f08a0b4c2fc3f39211683b3b9d9cb9bb897dee245ad3db5
Overview
overview
10Static
static
3EXCEPT~1.js
windows7-x64
10EXCEPT~1.js
windows10-2004-x64
10ETricks.exe
windows7-x64
1ETricks.exe
windows10-2004-x64
1SEHxmpl.exe
windows7-x64
1SEHxmpl.exe
windows10-2004-x64
1ring032/make2.bat
windows7-x64
1ring032/make2.bat
windows10-2004-x64
1ring032/ring032.exe
windows7-x64
1ring032/ring032.exe
windows10-2004-x64
1rline32/make2.bat
windows7-x64
1rline32/make2.bat
windows10-2004-x64
1rline32/rline32.exe
windows7-x64
1rline32/rline32.exe
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
EXCEPT~1.js
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
EXCEPT~1.js
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
ETricks.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
ETricks.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
SEHxmpl.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
SEHxmpl.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
ring032/make2.bat
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
ring032/make2.bat
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
ring032/ring032.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
ring032/ring032.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
rline32/make2.bat
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
rline32/make2.bat
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
rline32/rline32.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
rline32/rline32.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 46fa7795f8434ea22ff2d18f9a4ded29
- Size 22KB
- Sample240106-xvm37seabr
- SHA256 52d95f79b909e1773f08a0b4c2fc3f39211683b3b9d9cb9bb897dee245ad3db5
- MD5 46fa7795f8434ea22ff2d18f9a4ded29
- SHA1 b227e754799f3a7cf26f24dc9d2bf5117fd7aaf0
- SHA512 a6bb4e5bd27197d75f3d062dd09204b47c9af89d0cfb845e2827e3f2651a0131c45ffc8e33110a5d55e7cf4fcfc98a95e3a6c1a5772b1c7768eeece1ea9d768e
- SSDEEP 384:nUYPI3wZKX+StsYyAMcNTCd+JzSGlTIbY3fzU1RTIO2dG:UYPIAHSt3yAMcgYpcYPI1j2dG
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack003/ETricks.exe unpack002/SEHxmpl.exe unpack004/ring032/ring032.exe unpack004/rline32/rline32.exe
File Explorer
-
46fa7795f8434ea22ff2d18f9a4ded29.zip 22KB
-
DESCRIPT.ION114B
-
EXCEPT~1.HTM.js 2KB
-
SEHINASM.ZIP.zip 21KB
-
ETricks.zip.zip 7KB
-
ETricks.asm8KB
-
ETricks.def177B
-
ETricks.exe.exe 3KB
-
ETricks.inc5KB
-
KnlxHndl.asm2KB
-
SEH.inc11KB
-
SEHinASM.txt646B
-
SEHxmpl.asm7KB
-
SEHxmpl.def274B
-
SEHxmpl.exe.exe 3KB
-
owl-seh.zip.zip 7KB
-
ring032/make2.bat153B
-
ring032/ring032.asm3KB
-
ring032/ring032.exe.exe 2KB
-
rline32/make2.bat153B
-
rline32/rline32.asm3KB
-
rline32/rline32.exe.exe 2KB
-
rline32/rline32.txt5KB
DESCRIPT.ION
- SHA256 b7822662e0bfd7856d076511dba221a319f399fafbda5a1e2ae919d1c0066c77
- MD5 cc05f1f9704d7254d1f169fbacac180b
- SHA1 81c5351d79c91a93e9b61017ccc50e72bcc82a24
- SHA512 96341d600ffa17c821a99eb73fb5534bb7df75e80f24eb8fc65f8e094dfbb4b89592a00b918ace72c4c4d16a0bd0d8fcdcbd94c5c716348492747a44c5eca467
- MD5 SHA1 SHA512
EXCEPT~1.HTM
- SHA256 9e9af91bd4ebb21effe74641e4c12d5fe75442241929b0c5f60385a8769971d2
- MD5 c2048e49057a4c1d832f26c3dece8eb1
- SHA1 710cf2c75853d3069c30fce23f4d6d5b0ba59e28
- SHA512 0ae8bfface8c5278c0ff8635025d67257d16e3ff8c756b70e7e34372e7f6a439c620d08c57ac5d9f09372e13e7bf5bc47740aebe21873304ef8b031b09f00f11
- MD5 SHA1 SHA512
SEHINASM.ZIP
- SHA256 deadbc8bcf04fa183e971567c7759399a4609e7b6323639971e355c2486f565a
- MD5 5d57f66f1fb9cde826c56c7781ddddb6
- SHA1 6d17f5f9b0ef317ea5fdb7e42350a0aadb971dc5
- SHA512 ac868c1211d4ebd477e7b9beb8f6a80494bd34a5d3385224be848dba3319aebb6756991a958efe12d8f2243965ead03dc9f44b68e5545d1403b00b5c99ad3d04
- SSDEEP 384:ivcc8ewlqn5EnLocDPjVj2kqtC538CJUaQoAwDXADS3uvJ4UvQb6SG6PnRXDE1G:i912n8cDx2kl5kanNDXhebQbJHDEg
- MD5 SHA1 SHA512 SSDEEP
ETricks.zip
- SHA256 56f83493629e83f31300377b4ec45c7cc778592e93bf4cb6544f21e1af2bb38d
- MD5 641cef11185e2a8caae777dcaf2dda02
- SHA1 8f6c7f8df2d3646b8857d4ebd79791c3d143b194
- SHA512 c22d2a45c35aa6ff38413388835a26fc136e293be50e29b0f150f2fc0c86c897ea6f820946b843c28bf06434a8e8dcfcb4fb618258d24b3bece3d552a01ca56a
- SSDEEP 192:uWsgnH8BuawaV6qcmYCu652XRTuGum1YO4Wc7bVzW4QhBn:uWlcBcaj07CGzh4W6VKTbn
- MD5 SHA1 SHA512 SSDEEP
ETricks.asm
- SHA256 905cbebc5a571d5fe859f30938122a7b91b59f61fd1979c06de0ba50ee51fa8c
- MD5 179cce44cc867aef8ed6285b67afe37d
- SHA1 bf3c7695ba52d37ab9eefdd1f52da54d6971136d
- SHA512 934599f4ea969a258eaaa7efaa22c7f7d277a74512f997b79b3fd64e7c247794556ce006d4f0769eac7975902ce35f4fba96b5353bb7d79fe98c9c868efea748
- SSDEEP 192:kITuQagfaQQI1qvX9RnAx7J6WhD2BgWkjR:JTuQaeaQnOXrAyYKSW+
- MD5 SHA1 SHA512 SSDEEP
ETricks.def
- SHA256 9c92c9225a52351b2b82193c53e9a03e649990152ad21db56f465365c80e51b0
- MD5 a7e7804179c1e695ba7ccce4ea2f2648
- SHA1 9ef93051b07a69ede36d1aa0db41d745ed9f66fc
- SHA512 d51740b679c4619f17b25b772c6eec604a7b482083645591ce7d124fbad7b84ca93f207cb2467e9261d45c6848190834b845ef6a8d9a06e5296ced55d78a411f
- MD5 SHA1 SHA512
ETricks.exe
- SHA256 20ba9767f4fd1269a3dd1a4b6467bedbb966cc4d31d2fcb3e569844b1eed861c
- MD5 b1a941506ec6fab5ef351a7b3b207220
- SHA1 eb86985cd551228a387964c36ea59e7c73f2d89e
- SHA512 a2ea778b92065bca49a962321d8176e04e0ef90e8a8abded51b56b91f9501395897228467dc0e7336cd6997ea71d31606298d088fe656e05c5748005bfa52959
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ETricks.inc
- SHA256 cc070b9f9d1dac4027e66f6bef8488fa06f41af3654db19d7e445e41aa47d53f
- MD5 b015d5a4531ded2fac1a692f17be8893
- SHA1 9a5b9410eedd001a6a29e86591d2a10e3130066f
- SHA512 8a12fe75d86f35eb40908642eaea43b625196d070f3bbc0eb157d0856741bca1d714b34d86c4908ce97b8776b510d713a96c43286cfe7d299a2df68fad105bbb
- SSDEEP 96:6WLhQGkZE8rkjxtIRu2stH0vKWgWgAbCiYou7Q:66CGkZ9WUu2slWgWZEQ
- MD5 SHA1 SHA512 SSDEEP
KnlxHndl.asm
- SHA256 800cfcf4e4f3739de5ec716ff5144114f427ead233dd8b542e41e8cf0a5a5167
- MD5 c20a6191f91f160c1132afa09f0b9adc
- SHA1 df5e28b6022d942717b57ddc0d0189ccf88fbb7a
- SHA512 1a1f8d5cdaaddbdce560c851ef308ab57cc45cc369da5adeda58e7e63bc767c907d61c807166c453444fa900138208117f8fc06ecc0974a77b00240df172b9fd
- MD5 SHA1 SHA512
SEH.inc
- SHA256 b63fb239808fab1a78ee40828ebecb823b9d16c0a2f793fe50098e587fb69e6a
- MD5 bfff82da034a1c1b5f3402914ceb2970
- SHA1 38f9dbd4fe7ed8f0674fc4e6070800141686bb8c
- SHA512 eae5f6fcc2b43cabd2c352132f834e440697043975f9b854a34594b9ba09e328b624c4b398be197b61e143775d7d7fb947a80dfb47ba5eeb218e26fc325a061a
- SSDEEP 192:Y8jN4U/ZS+7wVzzx1mW/WUnItYeg3Cyym93VsmgErilh:Y8jCUBtGNWJtnD893VlS
- MD5 SHA1 SHA512 SSDEEP
SEHinASM.txt
- SHA256 0faca412af7d072b5411626494a8cedf7ca973b69fde839ad932cc587d404b2a
- MD5 7219576d2854ce750b55f73aec750ceb
- SHA1 3939726cec90591d7cf21240ad42df6eee1f7765
- SHA512 3b6aba38594625c6ffdf802a8f791c024d1f8dfa9c687164d14697c83fb3050834af70283998dfd51fc13e0d27729d407a6c40b9924da257db94a9bfffe0959b
- MD5 SHA1 SHA512
SEHxmpl.asm
- SHA256 10439624c8565b18276ca2f380545fccb9bf6e947584f011a2151d45a703ed67
- MD5 82a2ccb77e0e078df7d9ba91cbc83ffb
- SHA1 39aaa2f981a9c0aacbd7c3c3f955d2139e32cf35
- SHA512 960a2fba59aac4f093dc20199baedae2d87b2fb4514b58e210ee1901e4ecd33a1e7dc59ba7ccb0c85a5f98a8fbab46c1aaa6d32d875fb913973fd6e9ec58e9be
- SSDEEP 96:khBQX49MphwjDerT0lxhpvpVpJhxFT4eoZeNL6dLmcu:kh3MphgDerT0l9pJhtXcdKcu
- MD5 SHA1 SHA512 SSDEEP
SEHxmpl.def
- SHA256 ce9d8d19273ed78f0c3c6bafded32474dae4a8fe8871747f1418272c3b985cdc
- MD5 e912656c0df195466f0a6c2e6abb1e6a
- SHA1 5ce2ab0eb2db1821ac587bbdba262418c1cdc77b
- SHA512 e2f0ec8b26dc7297257a3cf2a778fb9cf4a6b7e79af5ebaba1c9fbba1833f304178fdb5563526ae3878fe87e6ee12d2dff62bc2925206d5acac6c5bb8f5c6890
- MD5 SHA1 SHA512
SEHxmpl.exe
- SHA256 2538a023338f92cba787f349e969a380c86dc48d33d138d47576ff4fefda0488
- MD5 475c82890dd4855aa5285233d76123ed
- SHA1 dad072665ad76388ec9165e8349d5e831882a46e
- SHA512 38fd994c0387efaaa619810d79fb8f10d587369778211329f8e49034c846b5732be75e42d74812cb82c55a54fbab084cfbf713a2aa362a6e7a4cc45ca2f938f4
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
owl-seh.zip
- SHA256 7b962dea04df1b8a3d38044f44893888ad48a074e8cf0311cc88706cfc538db6
- MD5 fdfed2a76377580780ce4b1a9c525246
- SHA1 df48790e377c26d8a98afc9a52407628533548ba
- SHA512 23f5f96aa3cfa130f7e55deb2e3cff2ab0d36a7bda5b3aa40dacfab4eef32e071ed5b6d849f34c4935e13f442b1e0b56d6c8af781b8c48b7df9b3fa61152f721
- SSDEEP 192:pictYZEdbIVX7T0lcH+lCwxCUU7S1Xf+FUkMlN8Au:krKbEX7+lle7qXf+FaY9
- MD5 SHA1 SHA512 SSDEEP
ring032/make2.bat
- SHA256 fa11299f3e1d5cd1c1d98a96f494e13beb4defdb8a74bcc84c912f1b1d9469ad
- MD5 49a3458ea1c08cb15412b1e74a940542
- SHA1 0a0f06667e4fe7c126bd78df8d0ea9cbe8799b09
- SHA512 f16e3212e21141d263bcedced1528f32b6b113d969653a89216e0327c81bf813ac42f55787f3d7bcd79f4ac40a84adeb9b294045d7c8a21d18b918e90117a8ef
- MD5 SHA1 SHA512
ring032/ring032.asm
- SHA256 2c8ffae9ffce5203d5a35b0b2ebcae4d3368cc2c96418efdfeed234860316212
- MD5 c6b752cae6c56f663b896ea2b7e7a605
- SHA1 95df186bbec77d83c00b85512f5bb49ecd08962d
- SHA512 8a2bc9f1809e1d99447d7b394c4dc3400b205d86a3d409a8cc570ccf155410be8dc0ed64ba9ac39c9db1a32358de72c296b3aa8a3b96b3b7f2f58d036fd95335
- MD5 SHA1 SHA512
ring032/ring032.exe
- IMPHASH 4040d31bab71c6d32a67892cd57b1ef7
- SHA256 ab32ebb8bbb71a8cf009759fee811f64b89b0a612ef02dad7791f6d50bed7422
- MD5 3afd046fdfe7a77bef0a9c951c93bc64
- SHA1 dc52d7dea76f36615299094583cc2de96d1170fe
- SHA512 dbad26b060812ff6f294be55394296ddd35e5a5553e689926fc43f208296651a85858e321556caf8d1ff250a3dc8882ab8762d25f949bcf74c27bc50ddc86ebd
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetStdHandle
WriteConsoleA
ExitProcess
user32
MessageBeep
Name
.text
Size
512B
Virtual Size
342B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
194B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=11, productName=Unmarked objects (old),
rline32/make2.bat
- SHA256 a700c5ff485ffff7b2d99a87091ab260be043948aab377e04cb19fe426a24558
- MD5 4f53d2abe3ecc47e62051ef10187918a
- SHA1 480578ffef6edcc15cdbf7eb947df7bf8213aacc
- SHA512 09a4933637df1e71374b12eb9911dcbff0128265836782ac3472dedfc71cdb9ff6077b851cf03660b8d7de429a5e8215c7140b2086137aa43cc417704eec04ab
- MD5 SHA1 SHA512
rline32/rline32.asm
- SHA256 5a118c5293ca9b6062ba3a95c6f947513838b1188c2d318823a3e2f4f9b16e58
- MD5 4e924765a22027d12aeccab4f91d4a0c
- SHA1 ae9281c70f3bd471efaf9fa798e0dda4c8dff1ed
- SHA512 a852d55a2faea77079d1fea38eb9c9b8c5f9638865c6231f8e73df956aa2d998fd0b8658a1f01e0b32ed6221da58d6eaa8cd72d176820e393f5ff3a8576ffa0c
- MD5 SHA1 SHA512
rline32/rline32.exe
- IMPHASH 4040d31bab71c6d32a67892cd57b1ef7
- SHA256 f7c76b2b3a874035b299527804e8ab39c2f7e7eaf3e8e794344b2f43c426f85f
- MD5 5fabdfc03826a3eab32fd984d783b3c6
- SHA1 cb2642ec51f68b60a0f7e86b056431d04726905e
- SHA512 c001bf3808c310834fb28e28d6ebbbce4ad7e94b830daee45d87f19f61e170f8a047e8cc67b9a3ef9ad7e5d00e092954617d600d1ca2be0af816b2d17f397240
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetStdHandle
WriteConsoleA
ExitProcess
user32
MessageBeep
Name
.text
Size
512B
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
194B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=11, productName=Unmarked objects (old),
rline32/rline32.txt
- SHA256 a5dc507d8e13a28b2063292b7f63916280f05930914cb028b704c8a339842c71
- MD5 efcf8af9ed655f4970f2d23062a68945
- SHA1 e272806c36da630de43821f5f2af8d0eb6661189
- SHA512 8c654d5ee8b04d8ca055daed3dadafa9f23d376f46961ca5a6dc979bfeb21fd89adb3fd1dc31cd595e0f385003f4a6f88d40a73660b314a39d543e885ef4bc88
- SSDEEP 96:80QODHEVS7OmipSFh8ZgHCHooJigtAJN4ztOcegdpHR0SUONUcteot:tQ7VS7O8Fh8ZgHCHoXoqNjclzHG9ON4q
- MD5 SHA1 SHA512 SSDEEP