Seven.zip
- SHA256 51233ecdae1ee0e9640ac749a1955a4dcb9e22a1c788cde46c3e8696a876ad8e
Overview
overview
6Static
static
3LethalComp...config
windows7-x64
3LethalComp...config
windows10-2004-x64
3Seven.deps.json
windows7-x64
3Seven.deps.json
windows10-2004-x64
3Seven.exe
windows7-x64
1Seven.exe
windows10-2004-x64
1Seven.exe
windows7-x64
1Seven.exe
windows10-2004-x64
6Seven.runt...g.json
windows7-x64
3Seven.runt...g.json
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LethalCompanyDLL.dll.config
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
LethalCompanyDLL.dll.config
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Seven.deps.json
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Seven.deps.json
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Seven.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Seven.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Seven.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Seven.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
Seven.runtimeconfig.json
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Seven.runtimeconfig.json
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Seven.zip
- Size 649KB
- Sample240421-3fqtfach4y
- SHA256 51233ecdae1ee0e9640ac749a1955a4dcb9e22a1c788cde46c3e8696a876ad8e
- MD5 110d25f0538d6a5f110595936f006f54
- SHA1 8ca7c2764a8775ba60dc126e323625907ce2ad19
- SHA512 4a01c82f34b935a1a4de498247d49f888aa0f27a207827251a922651454cd9fdef8eca2634fe6be945e335d6fc17d2d2c1a4b9afba150e2f671680b1c5cdbb17
- SSDEEP 12288:1BFxdq1VrlziudYhzGjObBdTeBtIS8X388IDwihxWjQwIR9I5kfjiJqZ/:1BFxdq1VrlOudwGi9QB5KTaPhxW9IDI6
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Seven.dll unpack001/Seven.exe
File Explorer
-
Seven.zip.zip 649KB
-
LethalCompanyDLL.dll.config453B
-
Seven.deps.json53KB
-
Seven.dll.exe 581KB
-
Seven.exe.exe 139KB
-
Seven.runtimeconfig.json340B
LethalCompanyDLL.dll.config
- SHA256 697b73a314a6006f7b4037f6b4b21b45d66e611f3898ce2f3b955973fb1fd9c3
- MD5 b4aa12b084100d8a456013de6342e0b2
- SHA1 b53ad2683f7e6cc08c350d51d164111395454556
- SHA512 c9029fffe68f0286b8c285f0772ec4dbebd5f63682e883393712a885cd226bf7d70d2d78c8f29cb812b5e875cba8f720db0381d3dd1d2a1feeb3ce15ab9b59b8
- MD5 SHA1 SHA512
Seven.deps.json
- SHA256 da5c391315d0a224e3cbba1b3d67d30323bdc9447bb2a1ad7d13324379f9250c
- MD5 8b939746962ad7b3ae8b9a858403273a
- SHA1 4158758f159b6fe3fe2ae2e138a637aeeec2b90d
- SHA512 cf540c667c8796ecaf9cb7efcd5cea771c384379fb5ce39293bca59b5eb624872f3b52beccc7a0c4e25b4b69f5d087aa777d0867f5906fb8d9ff3c6da5713fa8
- SSDEEP 384:CALYxOncu7IkYo/HtokzhO/uZkenMlXunNuRmkUfVgVL1ON2hjljtDxxAqGkyVSn:C2lcu7NnBQRSiL1ONeljpZKStg0hQG
- MD5 SHA1 SHA512 SSDEEP
Seven.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 adc7e663f2f0cc6e57d73adc7bd5db07e215cc7c5f5f74b5e5886ef2dacf0414
- MD5 7e555e7711ee6de1e70ad3abc12c312a
- SHA1 bc845eac7daf815cd483a86fdc5ed39454b0abd4
- SHA512 08ab3adb6eecd280216aa58bec419fa5fe04493bb103d43867bacb9fc3f22f52d0d43f9aeddafb16a987c3fdccc194ea4bc185ddf6fa86ae8de6806799d0e7d4
- SSDEEP 12288:LFx6q1VzlpCudYztGx0bndTWBtIG8RREeIhwGh7Wj2wIRTITaf7A/:LFx6q1VzlQudoGerEBnmBIDh7WDIFITi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
600398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Seven.pdb
mscoree
_CorExeMain
Name
.text
Size
578KB
Virtual Size
578KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Seven.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba
- MD5 350273e0d2e8a9ba5e37b791016112a0
- SHA1 5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71
- SHA512 b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b
- SSDEEP 3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8ltw:miS4ompB9S3BZi0a1G78IVhcTct
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33218,
count=18, id=259, version=33218,
count=86, id=261, version=33218,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33519,
count=1, id=258, version=33519,
Seven.runtimeconfig.json
- SHA256 28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
- MD5 253333997e82f7d44ea8072dfae6db39
- SHA1 03b9744e89327431a619505a7c72fd497783d884
- SHA512 56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
- MD5 SHA1 SHA512