Seven.zip
- SHA256 0723d19453b4817a76e85faeef4d255c9db8dbfee3f7c615632f9d09b452aa59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Seven.zip
- Size 1.1MB
- Sample240428-kw28ascd21
- SHA256 0723d19453b4817a76e85faeef4d255c9db8dbfee3f7c615632f9d09b452aa59
- MD5 54ec72bc5114aaf8cad016c0c5515a32
- SHA1 d7ff9ef2c49b6ad57b4bd96bd5aa844180120fae
- SHA512 b5a73a167a6614b3889bc8dadbe0e54743aefaac13a47d8431810871c9a55aeb01e87e88459b2e85e8eb7e0daf7ddc64fcc36b8b57c18d482f78ea11d3aae4de
- SSDEEP 24576:rjjmHcNa6tMiD5i0MuW7yqLPDlugdoXaaufUYNa46DP2Y4Nc:rNNam7dLayq9LdofusYcF
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Seven.dll unpack001/Seven.exe
File Explorer
-
Seven.zip.zip 1.1MB
-
LethalCompanyDLL.dll.config1KB
-
Seven.deps.json58KB
-
Seven.dll.exe 1.0MB
-
Seven.exe.exe 139KB
-
Seven.runtimeconfig.json340B
LethalCompanyDLL.dll.config
- SHA256 7acaff8b54cd21abe2187294420dcdbc2de3bf70346ea6a70e7b0dd0933d77e8
- MD5 3e6b6aa89a238b90d50dffa8f555e1ad
- SHA1 249d6ca60da03e30441c5533542c62af443b3271
- SHA512 f2ff96091f18fc3ebbbd8c566c8dceb437b7b57023bcbf5eb37f8f40a761e2cab6d9fdfd27c7ca217bd14718a40d99b3160cea9e558312f0c378d3a1ee96bfd0
- MD5 SHA1 SHA512
Seven.deps.json
- SHA256 00a040d1272927df989707aac3b1e8f12f5f6edd68fadd238451b89a26a7b6cc
- MD5 1f41fcdc46b910fac3bb1c8bd63467f7
- SHA1 dc4b9cd1e07006d682b911c6bc0d47b63776cb39
- SHA512 e42e18e5fd9fe58a0a0a75821a22a21cddddc9a626ac114b9c65a9d7d54c5d17bca57e9349ddae8e176a88f6619985c8438dc03d740855c3dae78f5176ee8814
- SSDEEP 768:CRlcu7+RC9qBLRyhL1OWQ04CZJSOv0irx:Ulcu7UgqBLRyhL1OWQ04CZJSO8it
- MD5 SHA1 SHA512 SSDEEP
Seven.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1000ce1d1099d16a3f34ef44a849f405a56bf814be0f2a1a0147b78258271e9b
- MD5 4fc931fb9a0607df0d1ed51c8ffb0fc6
- SHA1 49bf2f51747e09953c1d3e7be6e6de03ffe0ad52
- SHA512 d8bdf73017dd3a6d8955d7a0239e34d89ded1bfe768f00d9254c4c75c1325621ebf11870af3501a91b9ddf656c8e50da98eecf084326b9753f954aac85f8ba31
- SSDEEP 24576:9AiJuLaitoiH5M8MuWRCqjPxlSgdwf4ieJAwdEA65PmK+/m:GLae/h90CqLXdwVeOwKA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1098350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Seven.pdb
mscoree
_CorExeMain
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Seven.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 afd7657f941024ef69ca34d1e61e640c5523b19b0fad4dcb1c9f1b01a6fa166f
- MD5 6503f847c3281ff85b304fc674b62580
- SHA1 947536e0741c085f37557b7328b067ef97cb1a61
- SHA512 abc3b32a1cd7d0a60dd7354a9fcdff0bc37ec8a20bb2a8258353716d820f62d343c6ba9385ba893be0cca981bbb9ab4e189ccfeee6dd77cc0dc723e975532174
- SSDEEP 3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8lto:miS4ompB9S3BZi0a1G78IVhcTct
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33218,
count=18, id=259, version=33218,
count=86, id=261, version=33218,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33519,
count=1, id=258, version=33519,
Seven.runtimeconfig.json
- SHA256 28329cf08f6505e73806b17558b187c02f0c1c516fe47ebfb7a013d082aaa306
- MD5 253333997e82f7d44ea8072dfae6db39
- SHA1 03b9744e89327431a619505a7c72fd497783d884
- SHA512 56d99039e0fb6305588e9f87361e7e0d5051507bf321ba36619c4d29741f35c27c62f025a52523c9e1c7287aabf1533444330a8cdf840fa5af0fa2241fcb4fc2
- MD5 SHA1 SHA512