C-razy_Menu.zip
- SHA256 15269e56fd37d88875e75b23bd97d3a37f3fce4ab693aa3b57968170480debe1
Behavioral task
behavioral1
Sample
C-razy_Menu.zip
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
C-razy_Menu.zip
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
00003118-B352-C9BE-31B9-0000F594.tmp
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
00003118-B352-C9BE-31B9-0000F594.tmp
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
grf89dawg3u3.exe
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
grf89dawg3u3.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target C-razy_Menu.zip
- Size 3.9MB
- Sample240422-asw7rsda74
- SHA256 15269e56fd37d88875e75b23bd97d3a37f3fce4ab693aa3b57968170480debe1
- MD5 8ef024f1cd0b9cc2d6a169ba45d87100
- SHA1 dfa8b4587ace801b05f5fbf366a29281d879ec4f
- SHA512 e86e7378a3bd832cbec8c019fc2c0d7565bb6106877b244a33d62dbcf98f8035e81ea29c68212cac42211598520c6e4c5e1629612c94c02c312b13429a006a92
- SSDEEP 98304:i3eAg/21aXEzyEfWjXSLySU4xY5HNtFPbBxNAklX9YGv/RPOlbz:iuAg/PBXfJ5ttFDrNAklXFnYR
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/grf89dawg3u3.exe themida - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/grf89dawg3u3.exe
File Explorer
-
C-razy_Menu.zip.zip 3.9MB
-
00003118-B352-C9BE-31B9-0000F594.tmp40B
-
grf89dawg3u3.exe.exe 3.9MB
00003118-B352-C9BE-31B9-0000F594.tmp
- SHA256 a305d93439b5fb3c747fa7d60a179ab978983b005ac7e39184aabf2126279dde
- MD5 38a27412b25a3fd5a6f74b689dac3738
- SHA1 c132cd0bd984e706ac515e293546b14017acfa0d
- SHA512 f2a482351e7304acf9e32fe996eeeb5de3eb7b5f23a7c67056117a788a1759f0be2ee0ef13fbf0356b10aba78142579eb63c62679395a9b43da02243b69f7979
- MD5 SHA1 SHA512
grf89dawg3u3.exe
- SHA256 6a4d87783764fd14449e10493b4bcd4c381c4bd249c8344012444d6e9c5dc183
- MD5 ee1803d8172746c6e167ac8647877bb4
- SHA1 911b47ea1bbf05b45fd0dc3511f950543ae3f702
- SHA512 bfae8b541fc594dd8607740cbf5961abcfc9081baf0e2a8a6f734c41f0419605523b55d8fc37215ee7ff834bb9bed0ab3a9d171823121c47f4ad6a731c61f6de
- SSDEEP 98304:uNbYeqIiQAY8JcnotzFNGPYIHm9fcgVqmFoW7DnG:uqe3gYqtzFcNeDVqPW7DG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7065688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
268KB
Virtual Size
558KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
38KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
9KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
704B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, version=21202,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=263, version=30795,
count=6, id=257, version=30034,
count=2, id=156, productName=VS2010 build 30319, version=30319,
count=41, id=261, version=30034,
count=10, id=260, version=30034,
count=4, id=259, version=30034,
count=1, id=260, version=30795,
count=31, id=257, version=30795,
count=433, id=1, productName=Unmarked objects,
count=7, id=261, version=30148,
count=1, id=255, version=30148,
count=1, id=258, version=30148,