excel40macroschallenge.zip
- SHA256 024ef55d8112d913021e2f8e38294052c40d177062afebc1b462f396c86c297b
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
iroto.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
iroto.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
iroto1.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
iroto1.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
research-1646684671.xls
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
research-1646684671.xls
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target excel40macroschallenge.zip
- Size 103KB
- Sample240129-bts26sfaa4
- SHA256 024ef55d8112d913021e2f8e38294052c40d177062afebc1b462f396c86c297b
- MD5 542ead021ed9ecab2f5b6ff0edaf2f74
- SHA1 f1a509cb6dc15534a0b7ee29486789557a434941
- SHA512 d2e1514a891db86ec6275ffcb6f44503cedf9e4560d200eeefc3fe047e08c7769de1892b92ee71fe4663720652eb509a55c29e24e82d6deb8dbe5a741cd9cb95
- SSDEEP 1536:r6diRoyzKi0WAx5elOHwxvhuQcLE6/Q59VGqITfVuy03FD+/mUtzBxr:xutnmOQxvqEPHVZILVK1D+eUtX
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/iroto.dll unpack001/iroto1.dll
File Explorer
-
excel40macroschallenge.zip.rar 103KB
-
iroto.dll.dll 434KB
-
iroto1.dll.dll 434KB
-
research-1646684671.xls.xls 648KB
iroto.dll
- SHA256 055b9e9af987aec9ba7adb0eef947f39b516a213d663cc52a71c7f0af146a946
- MD5 e03bde4862d4d93ac2ceed85abf50b18
- SHA1 7d7c288a8cf7d4e5f64d616da699712b82760303
- SHA512 12e8ef09745a562567dc3d18e3be72dac09120e7756d47d23a605a82499b1ed8ff471578f0f85a35685de13c93f1ad0834a89dce5d136527f731b5e170a520f1
- SSDEEP 12:e9GSG2CTi/FfILQAu//6lgR0FWdzQ2VCARHUwOLe7EEe:e9GSnCTi9ALsQiQ296LG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
14407
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.code
Size
344KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=8, id=19, version=8078,
count=1, id=18, version=8444,
iroto1.dll
- SHA256 e05c717b43f7e204f315eb8c298f9715791385516335acd8f20ec9e26c3e9b0b
- MD5 8e6fbefcbac2a1967941fa692c82c3ca
- SHA1 242a7803adb19f638ef62077f1b76756f3a13a0d
- SHA512 bc6dc64fa5bc19f234e3df27f718a50f82f6f086da2cd761d81edda4cf9355b40115279ebc368a0f55cf651405e34988336f9f5c3577ce7a7433971194a7b179
- SSDEEP 12:e9GSG2CTi/FfILQAu//6lgR0FWdzQ2VCARHUwOLe7EEe:e9GSnCTi9ALsQiQ296LG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
14407
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.code
Size
344KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=8, id=19, version=8078,
count=1, id=18, version=8444,
research-1646684671.xls
- SHA256 b23491ede17f9a5b7d6ad27d3051a2224c214a5afa2139e5147bd26319577f85
- MD5 927005139a0be61efe849c715d875dd2
- SHA1 0f6a91916941d85b69e5320873a5d1c45055bc4e
- SHA512 30f40d913815f43395186b0957413e9f3f8999af97b3192372a4da86c6b5b32e3abd8adadb9623417521b57cff4e323d85d72e0e31c6be901b0926a0350c9b3e
- SSDEEP 6144:Hknl9oBdySAx76F6XeyTVtW/9Ny9ABnl5/PBgxOHjuM9Mq:jl5/WxIjL
- MD5 SHA1 SHA512 SSDEEP