163.5.169.28.zip
- SHA256 3f04d3267f818beec7a5f29a7780282bdf862a71669230b796b77700a494b55d
Overview
overview
10Static
static
10163.5.169....r2.hta
windows7-x64
3163.5.169....r2.hta
windows10-2004-x64
8163.5.169....r2.pdf
windows7-x64
1163.5.169....r2.pdf
windows10-2004-x64
1163.5.169....r3.hta
windows7-x64
3163.5.169....r3.hta
windows10-2004-x64
10163.5.169....r3.pdf
windows7-x64
1163.5.169....r3.pdf
windows10-2004-x64
1163.5.169....r4.hta
windows7-x64
3163.5.169....r4.hta
windows10-2004-x64
7163.5.169....r4.pdf
windows7-x64
1163.5.169....r4.pdf
windows10-2004-x64
1163.5.169....r5.hta
windows7-x64
3163.5.169....r5.hta
windows10-2004-x64
10163.5.169....r5.pdf
windows7-x64
1163.5.169....r5.pdf
windows10-2004-x64
1163.5.169....r2.hta
windows7-x64
3163.5.169....r2.hta
windows10-2004-x64
7163.5.169....er.hta
windows7-x64
3163.5.169....er.hta
windows10-2004-x64
8163.5.169....r2.hta
windows7-x64
3163.5.169....r2.hta
windows10-2004-x64
1163.5.169....ry.gif
windows7-x64
1163.5.169....ry.gif
windows10-2004-x64
1163.5.169....nk.gif
windows7-x64
1163.5.169....nk.gif
windows10-2004-x64
1163.5.169.28/cmd.exe
windows7-x64
163.5.169.28/cmd.exe
windows10-2004-x64
1163.5.169.28/cmt.exe
windows7-x64
1163.5.169.28/cmt.exe
windows10-2004-x64
1163.5.169.28/fd1.exe
windows7-x64
10163.5.169.28/fd1.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
163.5.169.28/SCAN-atoletter2.hta
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
163.5.169.28/SCAN-atoletter2.hta
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
163.5.169.28/SCAN-atoletter2.pdf
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
163.5.169.28/SCAN-atoletter2.pdf
Resource
win10v2004-20231222-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
163.5.169.28/SCAN-atoletter3.hta
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
163.5.169.28/SCAN-atoletter3.hta
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
163.5.169.28/SCAN-atoletter3.pdf
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
163.5.169.28/SCAN-atoletter3.pdf
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
163.5.169.28/SCAN-atoletter4.hta
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
163.5.169.28/SCAN-atoletter4.hta
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
163.5.169.28/SCAN-atoletter4.pdf
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
163.5.169.28/SCAN-atoletter4.pdf
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
163.5.169.28/SCAN-atoletter5.hta
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
163.5.169.28/SCAN-atoletter5.hta
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral15
Sample
163.5.169.28/SCAN-atoletter5.pdf
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
163.5.169.28/SCAN-atoletter5.pdf
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral17
Sample
163.5.169.28/ato_letter2.hta
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
163.5.169.28/ato_letter2.hta
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
163.5.169.28/atoletter.hta
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
163.5.169.28/atoletter.hta
Resource
win10v2004-20231222-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral21
Sample
163.5.169.28/atoletter2.hta
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
163.5.169.28/atoletter2.hta
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
163.5.169.28/binary.gif
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
163.5.169.28/binary.gif
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
163.5.169.28/blank.gif
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
163.5.169.28/blank.gif
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
163.5.169.28/cmd.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
163.5.169.28/cmd.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
163.5.169.28/cmt.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
163.5.169.28/cmt.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
163.5.169.28/fd1.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral32
Sample
163.5.169.28/fd1.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 163.5.169.28.zip
- Size 3.4MB
- Sample240110-1ba63sgfdp
- SHA256 3f04d3267f818beec7a5f29a7780282bdf862a71669230b796b77700a494b55d
- MD5 791696c6bca812e4b443238fe3f9d336
- SHA1 51e1eee80ddc458e38d8a8bace02f27ba49206bd
- SHA512 59ae4f46f85377333da911da93ed22ac28e5ec6b61bbf5b57ad2238290494fbf38b7c16ab994bd1cb69d0d3a48c0cc045dad40b377fc947b8d504bc95326ddfc
- SSDEEP 98304:zZo6YOMbyKDMs7Lv0Wu0usBtdfx7HofyhQIM37ME:VobFeKDBvvL9Jy379
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/163.5.169.28/msmng2.exe family_xworm - Detect ZGRat V1 1 IoCs
resource yara_rule static1/unpack001/163.5.169.28/msmng2.exe family_zgrat_v1 - Xworm family
- Zgrat family
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/163.5.169.28/cmd.exe unpack001/163.5.169.28/cmt.exe unpack001/163.5.169.28/fd1.exe unpack001/163.5.169.28/msfiler.exe unpack001/163.5.169.28/msmng2.exe unpack001/163.5.169.28/test.exe
File Explorer
-
163.5.169.28.zip.zip 3.4MB
-
163.5.169.28/.DS_Store6KB
-
163.5.169.28/SCAN-atoletter2.hta.html 1.1MB
-
163.5.169.28/SCAN-atoletter2.pdf.pdf 168KB
-
163.5.169.28/SCAN-atoletter3.hta.html 1.1MB
-
163.5.169.28/SCAN-atoletter3.pdf.pdf 169KB
-
163.5.169.28/SCAN-atoletter4.hta.html 1.1MB
-
163.5.169.28/SCAN-atoletter4.pdf.pdf 170KB
-
163.5.169.28/SCAN-atoletter5.hta.html 1.1MB
-
163.5.169.28/SCAN-atoletter5.pdf.pdf 169KB
-
163.5.169.28/ato_letter2.hta.html 1.1MB
-
163.5.169.28/atoletter.hta.html 1.1MB
-
163.5.169.28/atoletter2.hta.html 1.1MB
-
163.5.169.28/binary.gif.gif 246B
-
163.5.169.28/blank.gif.gif 148B
-
163.5.169.28/cmd.exe.exe 283KB
-
163.5.169.28/cmt.exe.exe 8KB
-
163.5.169.28/fd1.exe.exe 649KB
-
163.5.169.28/layout.gif.gif 276B
-
163.5.169.28/letter.hta.html 1.1MB
-
163.5.169.28/letter2.hta.html 1.1MB
-
163.5.169.28/letter4.hta.html 1.1MB
-
163.5.169.28/msfiler.exe.exe 419KB
-
163.5.169.28/msmng2.exe.exe 2.1MB
-
163.5.169.28/test.exe.exe 8KB
-
163.5.169.28/unknown.gif.gif 245B
-
__MACOSX/163.5.169.28/._.DS_Store120B
-
__MACOSX/163.5.169.28/._binary.gif176B
163.5.169.28/.DS_Store
- SHA256 d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3
- MD5 194577a7e20bdcc7afbb718f502c134c
- SHA1 df2fbeb1400acda0909a32c1cf6bf492f1121e07
- SHA512 58941214a8334331e52114aab851fc3d8d5da5dd14983f933da8735c24b0ddcac134e8f13692553199c4d9a14a4b3188b62878a30b9d696edda1204666b60837
- SSDEEP 6:VWAlXN6XkEslX/9ldlXSPnrtHP8//kHLEk0/ulXSPnrtHP8//k:QAXN9EEX/HnXw6XMLEk0/qXw6X
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/SCAN-atoletter2.hta
- SHA256 01e20536cc9847e7411bbb0e4d7381774f0e5e4cc86bfd6fdf0e12229d1d2786
- MD5 0e02311efc79d0580a3ae453f00cce83
- SHA1 77721025336c37d0df3349badaa71e6610c6d429
- SHA512 312589562ec740619629402876f4c077b56e0f3985686a6747c8c1d277f1bb56b41c21ef4fa1054178105a584692d3f6fc09af76e5edf4c6773826836c4b7bae
- SSDEEP 1536:y4pLmOmQ7Mf99jXfqe+Wjyosy3vmr/l1vcmafSIm+lIWFR3QXdpkJJ0sVaVMHfFP:y4pLZmQ7CJXReoz3zH
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/SCAN-atoletter2.pdf
- SHA256 3d29d9e8dd685c045d594a530a29c873b9d6c1957e9616675a0087746d592fa9
- MD5 94667972ade0e377d8edd7f16730a0db
- SHA1 7e097e209bfcef8f11ff319fc5d2953fa436875b
- SHA512 83fbf17fcf72f023f71a68583acdfcd65eeb8702c09f90d10af6e284eb400ce49802a3d26492e6cddc2406aadfdc1f6d14f01c7fc6498b6d2b836f60c81d3d67
- SSDEEP 3072:9pAXRLFm5rv1Wqu9r1RRbgz/hdcJ0XWLtSvi6dzRov5dMWv4yqF:+RLF8Bux5grI9c6DTMPyi
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/SCAN-atoletter3.hta
- SHA256 dceca8e7f6baca5bd3417c0e05a1e9e934a0c72fe36c79fd3aca451ea2168d76
- MD5 65a82ba108814502f8de8f9c918c1637
- SHA1 81bb281aff6d485787f79558b2433a529af5d53b
- SHA512 477a94c061e96c5b8cdc256e746eb9dbd57339c93bcbd90bb66e2b6d21a7ff9e35b3b0ac7eac7a4c2b308306b06178060c38bce1470f5d94af32d07a97ce2621
- SSDEEP 1536:MUQr+podgEt/pvBYwPBONWBImr/l1vcmafSIm+lIWFWY7Cy5h7OIxeZeDG52VP+q:ArooW8vhXBHuV
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/SCAN-atoletter3.pdf
- SHA256 354993c4965d7445b37c6b256f4c1c5c2086c0b1ec5736b9f179bcd6387a194f
- MD5 bcb62044282191bb5294c1435de71a18
- SHA1 69eaa574d9b0118424c7b204724351811aa0c015
- SHA512 d2737e5418b4bf0ec7ad736cb4707516e702667f57da1ead88cd0f012f188b087fca8520bb1fb9881356bc920027b177349905a2150784bbf79d039eb3c0e6ad
- SSDEEP 3072:AvVr51Wqu9r1RRVgz/hdcJ0XWLtSsi6dzRov5dMWP4y0LUy:8BuxHgrI9cLDTMPyo3
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/SCAN-atoletter4.hta
- SHA256 992820187d1f871cb816dfb5839c0a71dfde38626d6947b4d912d04cf585454d
- MD5 4bde59d84e71c0ff88901e353dbe3eec
- SHA1 3000483b2add41716148b8e11fa283f6db6a9cf1
- SHA512 38a11e2bbba9b26f5651d09f072109cb1b77717c53322a47147e1560016d409c528639be48f2044f038a6b24bad5cf0df200a83ca80c5a27d49fe5b91ecbb0b4
- SSDEEP 1536:sSdyqS4pxRNGWLPcX/WhEdbVhtmr/l1vcmafSIm+lIWFXvD+v/j53mD0QMYPhgg9:ldHzpxdPcPWhqxki
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/SCAN-atoletter4.pdf
- SHA256 753a2e33fc19c1436650f392c23429728a97f4c941bd5493bc227ab04f6f231d
- MD5 6959cdb24cc37e1a25fcf1b9aed58fcc
- SHA1 0659f4eb013280e21a057fa1c3843d4c0043ff90
- SHA512 b56f3c8584d30edcad363d1dc283c8b9edc0d13b4eb68755940f5400a6ea050a27677a1b744a0af1e7bf9ea8ff3af75a9991c20c153dbae0e64eafb3a863886d
- SSDEEP 3072:ccAr61Wqu9r1RRrgz/hdcJ0XWLtSCi6dzRov5dMWm4yyLUQ:TBuxBgrI9cJDTMEyK9
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/SCAN-atoletter5.hta
- SHA256 87b6bcaa19c9631310bb28100e1ed2c9f2b982fa5aaef48186da150d8d1c4ac3
- MD5 415d6911c9a6e92b5d3f050668592357
- SHA1 3f5ddfb1475a25201e443c61e31382100e8ddbae
- SHA512 6b322e26c4724efa648713c665d6eddc4f2191d9f3a7764076ae8fc8d5f13fd2301238e7aade65b49db71b0ecadd9333af42cfa7e98ae54b554a99eafc45a055
- SSDEEP 1536:zA8mj3XPCeaTTQT7L/1rTrZwsvCPA68WStimr/l1vcmafSIm+lIWFiWCK4vLwwlY:zA8mrfFITQTH/1rTrZ/CPArtQ
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/SCAN-atoletter5.pdf
- SHA256 57b4117e2cf9ab76ed554c2bbf192b9868b94202ad5aaff05a593cf3d4630f85
- MD5 c5de2a211a2580c04d1b5349651d3e4a
- SHA1 81a25e710c7dc63b10220dbdf39dc48ff11da5f3
- SHA512 ad3fead8c0e7820e008bdd9f90b443a20eab0dde9d51a1035e8b40f070d7e381e641a8ae00911bc8c0a4a8e341a9a73e3ee133b78abddbbb442f00ce28efd51d
- SSDEEP 3072:NPAr51Wqu9r1RRVgz/hdcJ0XWLtSsi6dzRov5dMWP4y0LUD:UBuxHgrI9cLDTMPyoC
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/ato_letter2.hta
- SHA256 e1869d3a88c9190cf43014e3cb48562fc220ff7f6d5baed77c7dfa1c84c5d530
- MD5 54ff1471d93aa84c94efd8cbae4c6c78
- SHA1 11c7d8cd8e02b27aee846c353c32b114a7daa3bf
- SHA512 5eed6c7f0ffc27e96349fa8fc7c959e87ff35561da2b811f2e59c0fa0bd42f53debd4079da4c1df133b8211c38ef48f03b3f8b5471370bcf6ed79d240fdde804
- SSDEEP 1536:SwxapK31kELNEZ1fos0mr/l1vcmafSIm+lIWFR9UU5gou0gQixFaVEYkEOvMXu+f:SOapK31RBEDws7g
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/atoletter.hta
- SHA256 6c4beabd874f9b38209eb0cc585fc19407edc997ffb0bf0897c34bf4552f5194
- MD5 47b67f1ef2ff1967fd6eee7f2eee2a79
- SHA1 e53cecf356df43405a19daf75ff5dcfd8b44f2ce
- SHA512 d9586f412e0a9cecc5909cde9391def8c338ca086ba506366076816f6a4ce8309176e884a133bc11bec731bf1d9bf3b027e42ef6a49b545b000ffee60c6d42b9
- SSDEEP 1536:jxr5/6p/OpbQEcQIKdquZcod/zA4l2ZFmr/l1vcmafSIm+lIWFeQnoxLPCQwkcUC:jxV6JsMEcQIQZcod/c4K
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/atoletter2.hta
- SHA256 8867f18c416e402fa6c470e2fa207e2ff1809b69a450356bd8a8c854edea4dd5
- MD5 3aa22e06354205638a0560dfd95ba73d
- SHA1 bd77bf64a070a8f233197e2db3cdef0879cc446d
- SHA512 ce75e12481f9840666fc783bed155779d75845e0b81f5679dd5ea801ad359527b389b611ca11eda321fb28d77dc10089ebf073c41aa00e51b921ea0cc1c28b8b
- SSDEEP 1536:qb0rlgqoroRgFUnAFzUbVlt9Ci5namr/l1vcmafSIm+lIWFjBoOuqpd2eWSFU4ww:qb0rlmrkgFUnAFgbVLFnG
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/binary.gif
- SHA256 8a31e7855292e0a8c66c67ff92ea660743006d47de9f012193cbd123a17ba79d
- MD5 96bd4beed88ff93356586485c13e5d89
- SHA1 399c2bc3d5ec4fdb4c7a597afdf19eeb64cbdf2d
- SHA512 069a292c7e5d2e8d76964e901f4922ae8948151c235436cf8abc67e84011f983cd052142381b8d3c7a417f42b06797a6a226da48155d5905e7d92c9847b346cd
- MD5 SHA1 SHA512
163.5.169.28/blank.gif
- SHA256 3cb0e54babf019703fe671a32fcc3947aab9079ec2871cf0f9639245cc12d878
- MD5 19517fb39a31be6b8d7ccf53ad84908f
- SHA1 ebbcfdc6acc99f7aac3bf7fe72bc55f07f03f7e9
- SHA512 be752ff4c7aa3ab46fdbd93555a17e422e7c8b8661f40f899f51ec9393b510dcb2e66436a4f2c78a42af77dd95e01a3438c88cfaa3e0b02694c1912d5294ee16
- MD5 SHA1 SHA512
163.5.169.28/cmd.exe
- IMPHASH 272245e2988e1e430500b852c4fb5e18
- SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
- MD5 8a2122e8162dbef04694b9c3e0b6cdee
- SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
- SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
- SSDEEP 6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
102224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
msvcrt
_setmode
exit
iswxdigit
time
srand
_wtol
fflush
wcsstr
iswalpha
wcstoul
_errno
printf
rand
fprintf
wcsncmp
_pipe
_commode
_lock
wcsrchr
realloc
towlower
_initterm
__setusermatherr
setlocale
_wcsupr
iswdigit
_ultoa
_cexit
_unlock
_exit
__dllonexit
_wcsicmp
iswspace
wcschr
fgets
??_V@YAXPEAX@Z
_pclose
ferror
_onexit
__CxxFrameHandler3
_open_osfhandle
_close
feof
_dup
_wpopen
_wcsnicmp
?terminate@@YAXXZ
memset
wcstol
_get_osfhandle
_dup2
_getch
towupper
memcmp
_setjmp
wcsspn
_fmode
qsort
__set_app_type
_tell
_wcslwr
longjmp
_local_unwind
_purecall
__C_specific_handler
??3@YAXPEAX@Z
memcpy_s
free
calloc
__getmainargs
_XcptFilter
_amsg_exit
??1type_info@@UEAA@XZ
memmove
memcpy
_CxxThrowException
_vsnwprintf
swscanf
__iob_func
malloc
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
wcscmp
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
NtOpenProcessToken
NtQueryInformationToken
NtClose
NtOpenThreadToken
RtlFreeHeap
NtFsControlFile
RtlDosPathNameToNtPathName_U
RtlVirtualUnwind
RtlFreeUnicodeString
RtlReleaseRelativeName
NtOpenFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetInformationFile
NtQueryVolumeInformationFile
NtSetInformationProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtCancelSynchronousIoFile
RtlCreateUnicodeStringFromAsciiz
RtlFindLeastSignificantBit
api-ms-win-core-kernel32-legacy-l1-1-0
CopyFileW
GetConsoleWindow
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
LoadLibraryExW
GetProcAddress
GetModuleFileNameW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0
CreateSemaphoreExW
InitializeCriticalSection
WaitForSingleObject
ReleaseSemaphore
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
ReleaseSRWLockShared
AcquireSRWLockShared
LeaveCriticalSection
CreateMutexExW
EnterCriticalSection
ReleaseSRWLockExclusive
OpenSemaphoreW
api-ms-win-core-heap-l1-1-0
HeapFree
HeapAlloc
GetProcessHeap
HeapSetInformation
HeapReAlloc
HeapSize
api-ms-win-core-errorhandling-l1-1-0
SetLastError
UnhandledExceptionFilter
GetLastError
SetErrorMode
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
InitializeProcThreadAttributeList
GetCurrentThreadId
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetStartupInfoW
CreateProcessAsUserW
OpenThread
CreateProcessW
ResumeThread
TerminateProcess
GetExitCodeProcess
GetCurrentProcess
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
GetThreadLocale
SetThreadLocale
FormatMessageW
GetLocaleInfoW
GetCPInfo
GetACP
GetUserDefaultLCID
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualQuery
VirtualFree
ReadProcessMemory
api-ms-win-core-console-l1-1-0
ReadConsoleW
SetConsoleCtrlHandler
SetConsoleMode
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
api-ms-win-core-file-l1-1-0
CreateFileW
FlushFileBuffers
GetFileAttributesExW
GetDriveTypeW
FindClose
FindNextFileW
CreateDirectoryW
GetVolumeInformationW
SetFileAttributesW
SetEndOfFile
SetFilePointerEx
WriteFile
DeleteFileW
SetFileTime
GetVolumePathNameW
SetFilePointer
ReadFile
GetFileAttributesW
GetFileType
RemoveDirectoryW
FindFirstFileExW
CompareFileTime
GetFullPathNameW
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
GetFileSize
FindFirstFileW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
GetEnvironmentStringsW
ExpandEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SearchPathW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetEnvironmentVariableW
SetEnvironmentStringsW
GetStdHandle
api-ms-win-core-console-l2-1-0
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
ScrollConsoleScreenBufferW
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FlushConsoleInputBuffer
SetConsoleTextAttribute
api-ms-win-security-base-l1-1-0
GetFileSecurityW
RevertToSelf
GetSecurityDescriptorOwner
api-ms-win-core-sysinfo-l1-1-0
GetSystemTime
SetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetWindowsDirectoryW
GetLocalTime
GetVersion
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
api-ms-win-core-systemtopology-l1-1-0
GetNumaNodeProcessorMaskEx
GetNumaHighestNodeNumber
api-ms-win-core-console-l2-2-0
SetConsoleTitleW
GetConsoleTitleW
api-ms-win-core-processenvironment-l1-2-0
NeedCurrentDirectoryForExePathW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyExW
RegDeleteValueW
RegQueryValueExW
api-ms-win-core-file-l2-1-0
MoveFileExW
CreateSymbolicLinkW
CreateHardLinkW
MoveFileWithProgressW
GetFileInformationByHandleEx
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
LocalFree
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
api-ms-win-core-processtopology-l1-1-0
GetThreadGroupAffinity
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
api-ms-win-core-processtopology-obsolete-l1-1-0
SetProcessAffinityMask
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Name
.text
Size
196KB
Virtual Size
195KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
780B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=70, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=27412,
count=22, id=260, version=27412,
count=297, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=9, id=261, version=27412,
count=41, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
163.5.169.28/cmt.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7
- MD5 dc0d40579447b035d980cf0b8cd7667c
- SHA1 c907f983cb27d5caec6c941e0712afcc973487d0
- SHA512 ed37522b52b617877b5e5f7023a0138baf396c0b33393d6155dbb6bfa4b3347b737e5493cbde634fa1937d0094a7b9b543929e6f32b35331a8c6dc838f38d51b
- SSDEEP 96:5g48vbNEbfZlmg9fVFBHDqPkNR0bejUoKKeyDvYKx4YG4qyZQFq+zNt:5ghJufi6tXy20Kj2KeyDQKqYXqMQMY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
163.5.169.28/fd1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2799308c4b285f662d2954b3d9900951d74ae0cdde04b80ff865221817103f3b
- MD5 b9a42052c81229de87b90370c7e8ef56
- SHA1 8253ef8fe65f68ea7e0cc11bcdc06ec91c8d3290
- SHA512 0e6a1b3d66c2401f8b8d5f8b2cae7d4912fa73565faf4c21686caa63a0d81eda952d6070edb57e7577c15c896caff3e52a6671713cfaa13ed21bab7accb86755
- SSDEEP 12288:tOSF/ZdMP5WlYj6Fs/HI6C96D7cyTZ33a33S333333dkS9Jy9:tLrMPkDFB6+2NkeO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
670302
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
647KB
Virtual Size
646KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
163.5.169.28/layout.gif
- SHA256 34e48e943934cb9f52afd1a3b0c60ccf56291d691ce3ce28f83e06e9a81be413
- MD5 36aef47334faa7e680be6436cb0ac0f6
- SHA1 8f540a691d02ce23df23cf2ac8df6a6caee8b234
- SHA512 3d973f8adf03e2d42917f8d03b607fd5423c504b5dd3f21bbebd831e8a666c0b3a0ccc4322b137d162b26f9f4788afce4fdfb473969e5509bd6e9613e0702ab8
- MD5 SHA1 SHA512
163.5.169.28/letter.hta
- SHA256 b41307cd7ec0456833713dc7075ada7d8884ca133c775c9ba8cbd464dc0c8f25
- MD5 7b2d71fbdd38daada881a1d5ba51bd79
- SHA1 4474d227759d362ae773e014aa7ff22541b69755
- SHA512 695d0ff4f9ce2cff8715e4cab13d713969bfc8e8adf563dda785c70be0ada0f7a5ff954eee238386ece74ad6eaf6110be7dc7e5aadaa4fc1bcc49e7bf061fa33
- SSDEEP 1536:If45HlQf84PEGMdETRrGXQmr/l1vcmafSIm+lIWFawmozsSQ8sBoCQnX2GgeGZ/F:IfQHlQNPfMdETJMMu
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/letter2.hta
- SHA256 cfe2176b15cb6044459b57401e56b5156a38fc03451d07a9d9b189fcc9fa8f2c
- MD5 13c9e9f7f8ce9480b18dbc989eb72944
- SHA1 56a3d29e9aa6859d2f3c599d1a28c5d85d0ee713
- SHA512 7389d08afc30a6174486bd2b71039cac41a685df47cb193d5a8d77c1c38464af96ea4ddb39d84f09b05d6941168cc91eb426702adb9647b9863d699215598867
- SSDEEP 1536:ZS1OkP/2puCdfNXfYP9TjJlNXsY6JAfny2mr/l1vcmafSIm+lIWFYoze/1oFv0+2:ZS1OkP/+FXfQ9TjJQYsAfnyB
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/letter4.hta
- SHA256 711f4c0c6e9d5433f7d658e6c7a6d40e73347f08afc5285af1f099e7333e5933
- MD5 4faa006670aeb4acdc9bc979a6d7cfa8
- SHA1 e9766a98e5c721b6f5f291ac2a0360f3e6aa483f
- SHA512 bcb1ac0b92359cee60650e1e630f33098fa8034582844e05d0d86e36010ada984bd21bd8cc75b59844bf5d847778257b9e0de1095cc2b0c54d02f0faeca94ed5
- SSDEEP 1536:/QE0zRmrv9m662wDcNzCYWKt3umr/l1vcmafSIm+lIWFjPP2txVUtEMAamHlvNKJ:4Eprv9m66DezR3K
- MD5 SHA1 SHA512 SSDEEP
163.5.169.28/msfiler.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815
- MD5 8a716466aa6f2d425ec09770626e8e54
- SHA1 62fb757ea5098651331f91c1664db9fe46b21879
- SHA512 54f11067e400347834689b4532ae53b00ec96a3ca90a2c21de27942f4ca30306fdda0522c1a3a4cde047ad650162e2d8313205220acaab4cc60e010965690940
- SSDEEP 6144:QTCsE3O4yuS5O0RBOInaCa6G6ypdf4Bf7e/DnjBeq04fVXOUvE0CGsSE9BLM:2E3O5uOO0mInnGZCTS84fZLtw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
434766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
417KB
Virtual Size
416KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
163.5.169.28/msmng2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 32ba94d58bb386a630c0f7ff76b730caa6e18dc023262bc160a4bc695d4d6ac2
- MD5 3b5757f632446842aac3ecd3f1c28366
- SHA1 4e00b5c8670c8a184632bdd48eedb3f90fdd4f19
- SHA512 bee2b4ea1025ba5fd47ace7b3d9d72527ec6511aeb113f1d709c3df0debcb09405e20c5d746719d2bd91b7f304469c2c7dc9f8b746bec953947bbb9583601c6d
- SSDEEP 49152:UqwmCCmvuorNkZQfE8UoGH3pRKl9+VvHu7fAws5Q:b8u8kainHPxVvHW3s5Q
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2207774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
163.5.169.28/test.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 36ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7
- MD5 dc0d40579447b035d980cf0b8cd7667c
- SHA1 c907f983cb27d5caec6c941e0712afcc973487d0
- SHA512 ed37522b52b617877b5e5f7023a0138baf396c0b33393d6155dbb6bfa4b3347b737e5493cbde634fa1937d0094a7b9b543929e6f32b35331a8c6dc838f38d51b
- SSDEEP 96:5g48vbNEbfZlmg9fVFBHDqPkNR0bejUoKKeyDvYKx4YG4qyZQFq+zNt:5ghJufi6tXy20Kj2KeyDQKqYXqMQMY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
163.5.169.28/unknown.gif
- SHA256 15f5fd53009f61c653aa23d91334f9d7fa2fbd325eab859b68d77a45bb6a78b8
- MD5 088e8e238b79e9ea2b4371abb91b1fea
- SHA1 dc1cdfa814046ea64609c438e1777f55ff3aa86c
- SHA512 3fd0722505117d869f0dda1f61644c30582e2a5e449452c8037c6c9360b4a4b1f11a8b5b9439a72be1a717ffdff7ee30c512d26740f6d0048cbe3ced4553e042
- MD5 SHA1 SHA512
__MACOSX/163.5.169.28/._.DS_Store
- SHA256 2f380f4a3d05a8d90c2106f50da75064e9ce57a598599dc5404f8f69a0223aa9
- MD5 b9a94cc8f4aac450fb21641eaf065c6d
- SHA1 0bed7e90c2bade9763fa18f1fb4441d31f91c87c
- SHA512 f1e82573db1da08be076ab30e7d8cff350e15d06765e1bb74e313cf5f93e1df6921893a3589df51e6b18538c21a9df6d3f23fead170e9b3c02993f5b5d4a2f4d
- MD5 SHA1 SHA512
__MACOSX/163.5.169.28/._binary.gif
- SHA256 0b7b840f11af0a9bb7d1b81e1d0dd87b3b995419b2cf19af31b13e2d1d8e0cd3
- MD5 6d0b13d1ce10731856e821b3ecc7f7cb
- SHA1 0bf86613ce2efd2bcb2a89f552ac88a6e636786b
- SHA512 7a277c7bf640693e74c2f35d8719a0980d179541743459c048a76fe8c825c0813b50aef9c5d1ee895b05e17c9d096aa1d4750f04430fb3e239fa893bc9857cf4
- MD5 SHA1 SHA512