D2.zip
- SHA256 4f260fbc7bde713d22a14689bdbf178e0f6ce58bd4be3d291b4db9be07857474
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
D2.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
General
- Target D2.zip
- Size 565KB
- Sample240513-wba4vsff5v
- SHA256 4f260fbc7bde713d22a14689bdbf178e0f6ce58bd4be3d291b4db9be07857474
- MD5 c6bfcaf55a8ad83b1252bd48d702be55
- SHA1 4908b7ba51a3974d1dfb6e0b7555469c9fbc2b8c
- SHA512 5a258c2c70b90c3723deca4f3542312000c5da281be1be0aed54ae41e5cf0a5ebf8c6cc33c1df1b09bfc6ca2c87541c4821f5a62b448c406514f25ef24a8db4b
- SSDEEP 12288:tayqb/55fO/qI0l9CRJmZMXywExzu1CYuBhvnFE:tVqbDOiI0l9imZ9zu1CdBJi
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/D2
File Explorer
-
D2.zip.zip 565KB
-
D2.exe 1.2MB
D2
- IMPHASH 0d00e7b5922fb5549ed71add897d60ba
- SHA256 79c1b2807322559ab1996ef9f704a4ae213d0b282c5f3972862eb1039a54edde
- MD5 257e39d3303af1aeb617348d24f6fd6d
- SHA1 312a83b35ecb90068d845736b85157d4832c5224
- SHA512 d88ff532f4e396ffef520f6f0ab7c9711cfe25c4cfd2e3ba84f7a8de6fc2d94942c54f66c467037d0000852b8539974b8d43c7ca754b012e6472b2d1eee9cd0b
- SSDEEP 24576:/KxiiAH280V6GfVDeRzFZMskrfQDmUx5Da1adHJFsF:/KAOV6GfVDePey7pdJFsF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4576
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\vnqim\First.pdb
kernel32
WaitForSingleObject
ExitProcess
CreateThread
VirtualAlloc
GetModuleHandleA
GetProcAddress
FreeConsole
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LocalFree
GetLocaleInfoEx
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetCurrentThread
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
SetConsoleCtrlHandler
GetTimeZoneInformation
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
CreateFileW
HeapSize
SetEndOfFile
Name
.text
Size
752KB
Virtual Size
752KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.bss
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
335KB
Virtual Size
341KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
270B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=29395,
count=174, id=261, version=29395,
count=21, id=260, version=29395,
count=3, id=257, version=29395,
count=93, id=1, productName=Unmarked objects,
count=18, id=260, version=33218,
count=20, id=259, version=33218,
count=79, id=261, version=33218,
count=1, id=261, version=33523,
count=1, id=258, version=33523,