8b27d0422226c40bca85688b2616be15
- SHA256 700cf70d8caa4bacbfd4c05f3b0df87eff70552ccbdae08f3c98ca70ffcbfc36
Behavioral task
behavioral1
Sample
Play.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Play.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
shivislesv120416+10tr.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
shivislesv120416+10tr.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 8b27d0422226c40bca85688b2616be15
- Size 1.2MB
- Sample240203-cwrgsshbgm
- SHA256 700cf70d8caa4bacbfd4c05f3b0df87eff70552ccbdae08f3c98ca70ffcbfc36
- MD5 8b27d0422226c40bca85688b2616be15
- SHA1 4b5f766e4683d339aa437b8a01f50bb67c1f5711
- SHA512 ec941a32fa3ea1ad7f7f2d0adafbc590eb027ca959575a395029c36a7707a2cc2d64f73778dab08d5beae89d18bf539abf0fc632e4153db97104e839ab47b53c
- SSDEEP 24576:09hSd3zlE8KBO5GuwjEk8ptIo3y8sqPf/YBsEPWDqCZsd4wm3LrvOxyBvrKv+:00zvXNwjuko3y8sqHrDqvd4LrvOxIrz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/shivislesv120416+10tr.exe aspack_v212_v242 - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Play.dll unpack001/shivislesv120416+10tr.exe
File Explorer
-
8b27d0422226c40bca85688b2616be15.zip 1.2MB
-
Play.dll.dll 35KB
-
shivislesv120416+10tr.exe.exe 1.5MB
-
trainer.txt6KB
Play.dll
- SHA256 c880e5075dbb5c7ddbe069f2df38a26073acaee2ad77dd74eb4f98d6ebfc21d5
- MD5 55761ae5528ca8a0a377a68112bb1154
- SHA1 dcffb53ce66ba6ee478e7d71aa1f0e9df12a9901
- SHA512 c60adccd6e0a250ef82a6018c7193516c9818b848d7c6ca225a2540cb274561eb8940cef8571005bfcc9868241c9768ac1465ea6283450c63b0a444b3f582d76
- SSDEEP 768:UT59z8PmIsX9mZKyQb62I5xzIGeDpzoTm/ct8tfq+G8D2:Uz8P1sUZKyj5xsGeDpzoCuafq+GL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14076
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
V2mGetTime
V2mIsPlay
V2mPlayFile
V2mPlayResource
V2mPlayStream
V2mSetAutoRepeat
V2mStop
V2mTotalTime
Name
CODE
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
21KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
243B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
708B
Virtual Size
708B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
shivislesv120416+10tr.exe
- SHA256 94a9d1329857430f634cf7b409561daf63c1b951b3bfab03434fb0dc31e1353a
- MD5 291c77646c557b7ae418459a1c2a10ea
- SHA1 0cf61108e281fb5949d5c91543943cdda2b705fe
- SHA512 88ffab0a7db9e5a0f1eba3dc107ba7b61f7ccda89e0f89df510d4d70e58a091ed2c020891dbffd1a27e0ec78e66326062eba2cb9032078effef41fa3786e22d9
- SSDEEP 24576:2+rtLI/TDzU8QtOFbwNEMo8pHIKBe8UGVKk7a/YvfwUZBDy6Bc1+emNfjkv2xARo:2gGDhvbwNl9eKBe83VKk7aGJDyT1+Xj2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4288513
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
526KB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.itext
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
29KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
544KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
655KB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.heLL
Size
271KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
trainer.txt
- SHA256 e2fbf7c0bc7266a8aa15de192d8250569c67696749d680f5717b45a222ddb56e
- MD5 a1e8e638abe787cfc67a949ba56bd437
- SHA1 f2cc8b0ee0b87d2b294ef1ca4423f4175d0c6f85
- SHA512 12f055e725ce12ffee52717862d996e9d0d2cfaeee104cef3d054e07206f67045e9cda5995c77b33c5229122805eb5823bf222a1d503b90b4ac0755ad1492b4f
- SSDEEP 96:A9ZYaqwX2ETeYuSqL3GPUJ/oTP7vlPs8urRVbsfcKe/nqkk:A/YajGETeYuSqRJ/oTP7vlPJu9Rlf/c
- MD5 SHA1 SHA512 SSDEEP