o_0.rar
- SHA256 65114d3b20ff207f78061f5ead760581f707369bff3276807c41db6782027f8c
Behavioral task
behavioral1
Sample
o_0/cheeto.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
o_0/cheeto.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
o_0/loader.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
General
- Target o_0.rar
- Size 8.0MB
- Sample240303-nf56sshf9v
- SHA256 65114d3b20ff207f78061f5ead760581f707369bff3276807c41db6782027f8c
- MD5 80a4a2b9c90ed81983d2ca746aab0e18
- SHA1 53c09e1047fd8faf73a67297d40869c32437e0ed
- SHA512 3ebf123faf5fa6e3235826af29e778d386798c0fd617c998d9d7c327fb1b47375432f2acc70981e81a79240b78a82631e44bb23913f1ff21aa09d50fca32a466
- SSDEEP 196608:s4P5B6nceudisddm2SFMOOLUh+oy/TcLS9ypLYLhbs5Wz0:s8B6vsa1FqLLotLRVAhz0
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/o_0/cheeto.exe themida static1/unpack001/o_0/loader.exe themida - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/o_0/cheeto.exe unpack001/o_0/loader.exe
File Explorer
-
o_0.rar.rar 8.0MB
-
o_0/READ ME!.txt585B
-
o_0/cheeto.exe.exe 4.0MB
-
o_0/loader.exe.exe 4.1MB
o_0/READ ME!.txt
- SHA256 f49ba2101c76cb8322fb009aca49f269492aa910d077c107e3b65a0180cefff2
- MD5 a69b6d387d97ef12d6ce3b02db810873
- SHA1 780a65fe632b3ee90150ac3ac05d2c9eb0cdd32d
- SHA512 acfbaf60b979866d52d2c264cd81db955a6fe4a0ac310a9eef31de6cea882ca5a6d30d1437a0f822b8a2ac4f814302093557495e4f4168c241d26c16e13d42fc
- MD5 SHA1 SHA512
o_0/cheeto.exe
- SHA256 d5bd2d1990de46d98907c10c535cfe81ed10a9682fac36e089946ccc14ce3e0c
- MD5 1d9d9eb4caf4a92c2f2f1bd44ab1b695
- SHA1 d61006c87b7b567566e1c06f2cad209380ff70be
- SHA512 558d7ec35fb8480917a8a37b8e9aef44a5cb58be0c1842be8d9f6224250273a7c6f9f4d64306a38630d76ecd5533bec4cc5115c7e320495087fc91109f5e5093
- SSDEEP 98304:3VAyZVmCs9rhcw3M//OfYts2SsJXkn7IG/HPiduYf:uyZVmCs9rhlSm0siJdeJE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7401560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
453KB
Virtual Size
951KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
101KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
94KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
20KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
275B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.imports
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=253, version=33218,
count=10, id=260, version=33218,
count=4, id=259, version=33218,
count=38, id=261, version=33218,
count=6, id=257, version=33218,
count=1, id=260, version=30795,
count=1, id=262, version=30795,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=2, id=260, version=32538,
count=2, id=261, version=32538,
count=43, id=257, version=30795,
count=598, id=1, productName=Unmarked objects,
count=39, id=265, version=33520,
count=1, id=255, version=33520,
count=1, id=258, version=33520,
o_0/loader.exe
- SHA256 60c57f14c2e0e0df0bda16646b21dddceaee0159dafbbb8daba310d4e1b5be6c
- MD5 9ecdc9ed1bea6c226f92d740d43400b9
- SHA1 b5b5066cd4284733d8c3f3d7de3ca6653091ae10
- SHA512 30bc705a2438288e3647d5adfc6119d751823970972b9c6b39a60384a2b7ac261986026b8d1c0b0ca7ee3d7e95363c97b873fdc5fad4096c903cb4e15bf57e43
- SSDEEP 98304:vnUGAC+hqc8lqvdzw2nsNKYYURyc9JirsN4JzmUPj:PTn2qcUzp6UYeJRCxPj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7561304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
393KB
Virtual Size
773KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
68KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
192KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
18KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
267B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.imports
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=261, version=32533,
count=8, id=253, version=32420,
count=10, id=260, version=32420,
count=4, id=259, version=32420,
count=35, id=261, version=32420,
count=6, id=257, version=32420,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=2, id=260, version=31629,
count=2, id=261, version=31629,
count=35, id=257, version=30795,
count=464, id=1, productName=Unmarked objects,
count=18, id=265, version=32538,
count=1, id=255, version=32538,
count=1, id=258, version=32538,