WinRAR-ZIP-Archiv (neu).zip
- SHA256 c8b41de669363ff7fecae244b46fcc2455cf09c10fd783815094659f912ee326
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
215c37360388d16653ffc1740c639d486753a9db69a8ad4f3e1b172b1b712df4.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral3
Sample
8d2f2ee24882afe11f50e3d6d9400e35fa66724b321cb9f5a246baf63cbc1788.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral4
Sample
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral5
Sample
f8da280bb9f81028c14d1e156d6685cdb5f75219a60f645f72e520fb5e388712.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
300 seconds
General
- Target WinRAR-ZIP-Archiv (neu).zip
- Size 661KB
- Sample240328-sgx9sshb9x
- SHA256 c8b41de669363ff7fecae244b46fcc2455cf09c10fd783815094659f912ee326
- MD5 3fb9302a9bb732ead22e983216cf9ce2
- SHA1 dde895a60d2e66a268ffca1e9c251cab6097a027
- SHA512 cabe19f842bda50b7d979f32217f3e95e6e0e2ac8b5827080939549e05931ee0a8cde9be7d41664a0be243b33dbddea1df0ccbebbf87004e801441a414f0ee39
- SSDEEP 12288:dcjOSQr11lCeqDBLT1VFj/ofBWy0tVKmhxfQRcQ2qq0HKiDSfutT/a8PBN:uaSQJ1ll0V5ofx0tVKCxfQRcQ2EH2fuf
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/215c37360388d16653ffc1740c639d486753a9db69a8ad4f3e1b172b1b712df4.exe.old unpack001/5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9.exe.old unpack001/8d2f2ee24882afe11f50e3d6d9400e35fa66724b321cb9f5a246baf63cbc1788.exe.old unpack001/d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9.exe.old unpack001/f8da280bb9f81028c14d1e156d6685cdb5f75219a60f645f72e520fb5e388712.exe.old
File Explorer
-
WinRAR-ZIP-Archiv (neu).zip.zip 661KB
-
215c37360388d16653ffc1740c639d486753a9db69a8ad4f3e1b172b1b712df4.exe.old.exe 32KB
-
5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9.exe.old.exe 208KB
-
8d2f2ee24882afe11f50e3d6d9400e35fa66724b321cb9f5a246baf63cbc1788.exe.old.exe 362KB
-
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9.exe.old.exe 338KB
-
f8da280bb9f81028c14d1e156d6685cdb5f75219a60f645f72e520fb5e388712.exe.old.exe 15KB
215c37360388d16653ffc1740c639d486753a9db69a8ad4f3e1b172b1b712df4.exe.old
- IMPHASH db206e36db5c9492ce02c61a679129e2
- SHA256 215c37360388d16653ffc1740c639d486753a9db69a8ad4f3e1b172b1b712df4
- MD5 9de48e7cfc2bc56631387e527f859efd
- SHA1 959b863e84103132f89a10a7fd6981771881f763
- SHA512 0f899f44536b651b97204dd876013796c6835d0562d04c479ba3b73032ab15edc8307f9f2d96057a673a5f12be16e85a084dc73e6c76b73f8646e8f354bea2f7
- SSDEEP 768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpNEmK/4BM:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
BeginPaint
DispatchMessageA
DrawTextA
EndPaint
TranslateMessage
GetMessageA
PostQuitMessage
ShowWindow
UpdateWindow
MoveWindow
CreateWindowExA
RegisterClassExA
DefWindowProcA
MessageBoxA
SendMessageA
LoadIconA
DestroyWindow
LoadCursorA
GetClientRect
GetWindowRect
kernel32
GetLastError
lstrcpyA
GetModuleHandleA
GetCommandLineA
DeleteFileA
CloseHandle
CreateFileA
gdi32
DeleteObject
CreateFontIndirectA
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=148, productName=Unmarked objects (old),
count=4, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=11, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=687, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,
5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9.exe.old
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5e902a138174c34e5445685c82b2044e0b35565854471aaccef0315c77288dc9
- MD5 12bc78e07cb69dd6ec32729240dbe537
- SHA1 7b7d9b115ec10074f7166ec3379fead6e816da59
- SHA512 c974592671b081d0af48c1aab9f9f02243773a081d9fadf70e3caa7454dca657b45bece27852397e74f601df1abdf5db496c821a5df624057355fd15c807e15a
- SSDEEP 3072:GXbUMNAwQ2Jpo/AkQCUyevi8xRpz81NADJ2:ibUMKwQ2J4ReviSjeKN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
214890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
202KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8d2f2ee24882afe11f50e3d6d9400e35fa66724b321cb9f5a246baf63cbc1788.exe.old
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8d2f2ee24882afe11f50e3d6d9400e35fa66724b321cb9f5a246baf63cbc1788
- MD5 7fefb77a270715166ddd1e323695a9bd
- SHA1 a8bf6a35a9605932332d44ff6983a83febb0b99f
- SHA512 de27be7ce7bc5443f0117d0cf0ec9e02266339a23c07a966baa741cd736d3539c7806801186fe3a940f843da4b0b4ebbd55e8c50d6c32c760ef578b17f48b121
- SSDEEP 6144:XW8Abuyx83ECgS8DBN8+betvD0tU0qOixjuxduaZ2YjkwEL/S:m8uxp9C+SqiyduMzkwEr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
376166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
359KB
Virtual Size
359KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9.exe.old
- IMPHASH 7e8ad4139efc6cbcf31df3bc4b291dd8
- SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
- MD5 04fb36199787f2e3e2135611a38321eb
- SHA1 65559245709fe98052eb284577f1fd61c01ad20d
- SHA512 533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444
- SSDEEP 6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7680
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
_except_handler3
memcpy
memmove
_vsnprintf
_vsnwprintf
_purecall
memset
kernel32
LoadLibraryW
FreeLibrary
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
lstrcmpA
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalFree
CreateMutexW
ReleaseMutex
FindResourceExW
LoadResource
SizeofResource
LockResource
CreateProcessW
SetFilePointerEx
FindNextFileW
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
GetDateFormatW
GetTimeFormatW
GetCurrentThreadId
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
GetEnvironmentVariableW
CopyFileExW
GetUserDefaultUILanguage
DeleteCriticalSection
FindClose
FindFirstFileW
DeleteFileW
GetFileTime
SetLastError
GetFileSizeEx
FlushFileBuffers
ReadFile
WriteFile
SetFileTime
ResumeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
SetFileAttributesW
CreateFileW
GetFileAttributesW
Sleep
GetTickCount
MoveFileExW
ExpandEnvironmentStringsW
GetVolumeInformationW
GetDiskFreeSpaceExW
WaitForMultipleObjects
ResetEvent
GetTempPathW
GetLogicalDrives
GetDriveTypeW
LocalFree
CloseHandle
CreateEventW
GetLastError
GetHandleInformation
SetThreadPriority
GetModuleFileNameW
GetCurrentThread
GetModuleHandleW
SetEvent
GetComputerNameW
WaitForSingleObject
SetErrorMode
GetCommandLineW
ExitProcess
CreateThread
user32
MessageBoxIndirectW
InSendMessage
ClientToScreen
GetWindowLongW
GetClassNameW
GetCaretPos
TrackPopupMenu
AppendMenuW
GetCursorPos
CreatePopupMenu
SetMenuDefaultItem
DestroyMenu
LoadIconW
CloseClipboard
EmptyClipboard
OpenClipboard
SetClipboardData
SystemParametersInfoW
ScrollWindowEx
GetSystemMetrics
UpdateWindow
SetScrollInfo
MessageBoxW
EndPaint
ScreenToClient
GetWindowRect
DrawTextW
GetParent
GetClientRect
IsDialogMessageW
DestroyWindow
BeginPaint
DrawFocusRect
IntersectRect
GetDlgItem
SendMessageW
GetDlgCtrlID
SetWindowTextW
MoveWindow
GetDC
ReleaseDC
CharLowerW
PostQuitMessage
MsgWaitForMultipleObjects
TranslateMessage
PeekMessageW
DispatchMessageW
SetTimer
PostMessageW
SetFocus
RegisterClassExW
FlashWindowEx
InvalidateRect
GetWindowTextW
MonitorFromWindow
SetWindowPos
ShowWindow
GetForegroundWindow
AdjustWindowRectEx
IsWindowVisible
GetMonitorInfoW
DefWindowProcW
DialogBoxParamW
SetWindowLongW
EndDialog
CreateDialogParamW
MonitorFromPoint
UnregisterClassW
SetForegroundWindow
GetKeyState
ReplyMessage
GetScrollInfo
CreateWindowExW
advapi32
CryptAcquireContextW
RegSetValueExW
RegEnumKeyExW
RegFlushKey
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptGetHashParam
CryptCreateHash
CryptDestroyHash
CryptHashData
RegCreateKeyExW
RegCloseKey
CryptExportKey
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW
shell32
SHGetFileInfoW
SHGetFolderPathW
ShellExecuteExW
CommandLineToArgvW
uxtheme
SetWindowTheme
gdi32
GetDeviceCaps
CreateSolidBrush
GetObjectW
CreateCompatibleDC
SelectObject
DeleteObject
SetBkMode
SetBkColor
DeleteDC
SetTextColor
GetObjectA
CreateFontIndirectW
comctl32
InitCommonControlsEx
ord413
ord410
shlwapi
StrCmpW
StrCmpNW
StrCmpIW
PathMatchSpecW
PathRemoveBackslashW
PathAddBackslashW
ord12
PathFindFileNameW
PathRemoveFileSpecW
PathUnquoteSpacesW
StrChrW
PathQuoteSpacesW
msimg32
AlphaBlend
winhttp
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpWriteData
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpOpen
gdiplus
GdipAlloc
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipCloneImage
GdiplusStartup
GdipDeleteBrush
GdipCreateBitmapFromStream
GdipCreateFontFromLogfontA
GdipSetStringFormatLineAlign
GdipDeleteFont
GdipDeleteGraphics
GdipDrawImageRectI
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipDrawString
GdipCreateFromHDC
GdipSetStringFormatHotkeyPrefix
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateFontFromDC
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdipFree
GdipCloneBrush
ole32
CoInitializeEx
CoUninitialize
CoTaskMemFree
StringFromGUID2
crypt32
CryptImportPublicKeyInfo
CryptStringToBinaryA
CryptDecodeObjectEx
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
248KB
Virtual Size
247KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=316, id=1, productName=Unmarked objects,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=211, version=60610,
count=1, id=201, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD3 build 60610, version=60610,
f8da280bb9f81028c14d1e156d6685cdb5f75219a60f645f72e520fb5e388712.exe.old
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f8da280bb9f81028c14d1e156d6685cdb5f75219a60f645f72e520fb5e388712
- MD5 aedb1ad5304921ac3883570ebb647a29
- SHA1 eb91ca0baf1e7be6b538871714c727232a981acf
- SHA512 6bbe14d668223b1b43e4ce9f7a75eb5892a2cd917b9e725edfda490113860a2ba8971cdbdef33e60a473fd0f831af1812ee6c4671f64be2c45958fa68fe4e88c
- SSDEEP 384:nl+IiU+Xh2GFstXnzVmzN/Gv2utvWmIptYcFwVc03K:ox2GGtpG6NfctYcFwVc6K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\ezz\source\repos\Mionoho\Mionoho\obj\Debug\Mionoho.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ