samples.zip
- SHA256 78ffb8426b47cac183d50f6ae9ac80525d4f316ccf46bcd9d181d1459138a471
Password
infected2024!
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00043dfa22ecfa878b76ad185f091123430dbbc1610140b28ff9036e4a7b53b5.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
00043dfa22ecfa878b76ad185f091123430dbbc1610140b28ff9036e4a7b53b5.exe
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
300 seconds
Behavioral task
behavioral3
Sample
00043dfa22ecfa878b76ad185f091123430dbbc1610140b28ff9036e4a7b53b5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral4
Sample
003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
Resource
win10-20240404-en
windows10-1703-x64
4 signatures
300 seconds
Behavioral task
behavioral6
Sample
003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
300 seconds
General
- Target samples.zip
- Size 254KB
- Sample240529-b4sjdsdc8v
- SHA256 78ffb8426b47cac183d50f6ae9ac80525d4f316ccf46bcd9d181d1459138a471
- MD5 6694cba3bba1098ad9347c5e8ea6c49f
- SHA1 8e51bad6b888c2e33354bd77d6772041ecbe03ef
- SHA512 b31be005a3b76fc4401759a3e6192bea24d94c9c162dcaed5d41e86c9db59976bb7d608d030b7696d7251920bf3715a0071cf9a1fb14c2454b4e041ccd34a203
- SSDEEP 6144:ZSZN8miF7hDWfD8h4MYiaMEmyIRAugU1Tagi6mOosss7pn:ZSDJD7MYiaMEoJgMpn3os/pn
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/00043dfa22ecfa878b76ad185f091123430dbbc1610140b28ff9036e4a7b53b5 unpack001/003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6
File Explorer
-
samples.zip.zip 254KB
-
00043dfa22ecfa878b76ad185f091123430dbbc1610140b28ff9036e4a7b53b5.exe 242KB
-
003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6.exe 213KB
00043dfa22ecfa878b76ad185f091123430dbbc1610140b28ff9036e4a7b53b5
- IMPHASH 1cc886f9c6a2b3ca910ec662922e811e
- SHA256 00043dfa22ecfa878b76ad185f091123430dbbc1610140b28ff9036e4a7b53b5
- MD5 6dfe59a2d3549e3a6f300adbced09e1f
- SHA1 273d5108cf4ed196e766d910c24f2305feaf7d2b
- SHA512 55e52cb24702a31a56b963b9c8566c14dbd4b0f80cb63606f54d84dd80edf458631e9af2ad15d17a4e4c931fc6fb104b844f8271fb4eb0bda3ebc73e2fa37aaf
- SSDEEP 3072:Ig1HtQbUh5cAV1J3n4Lou+shC7bA4fV+5ugUI:51HcUXfnu2PdfVl1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected2024!
Minor OS version
0
Major OS version
5
Entry point
9029
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ReadConsoleA
SetDefaultCommConfigW
SetConsoleScreenBufferSize
SleepEx
GetModuleHandleW
GetProcessHeap
GetConsoleAliasesA
GetConsoleAliasesLengthA
ReadConsoleOutputA
EnumTimeFormatsW
ActivateActCtx
ReadProcessMemory
GetVersionExW
FindNextVolumeW
GetFileAttributesW
FileTimeToSystemTime
GetShortPathNameA
InterlockedExchange
GetCurrentDirectoryW
SetLastError
GetProcAddress
BuildCommDCBW
LoadLibraryA
UnhandledExceptionFilter
LocalAlloc
SetCalendarInfoW
FindNextChangeNotification
HeapLock
GetModuleFileNameA
SetConsoleTitleW
FreeEnvironmentStringsW
CompareStringA
DeleteCriticalSection
SetCalendarInfoA
InterlockedPushEntrySList
CommConfigDialogW
GetLastError
HeapReAlloc
HeapAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
EnterCriticalSection
LeaveCriticalSection
HeapCreate
VirtualFree
VirtualAlloc
Sleep
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
HeapSize
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
CreateFileA
CloseHandle
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
27.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=150, version=20413,
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=100, id=131, productName=VS2008 build 21022, version=21022,
count=42, id=132, productName=VS2008 build 21022, version=21022,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=110, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6
- IMPHASH 1a4eff9c4d3cb3a6772cfd44c9b889f6
- SHA256 003baf8fb85ce28e21505c8a72d76c67f6aa2b107bae82662d1b56f68198ceb6
- MD5 c143fa19a5123ae26eb5871035bf3f29
- SHA1 b972a83d721f1b596234e198880b7a726af6b768
- SHA512 ec756a7e5cc130d774170fdbc0af86a3c66530f24725d470b560fcb127c8b91786bbac85b17175dd6ef0dbdaf52160fda936e40f19772139e9bbf4353d2717f0
- SSDEEP 6144:sjd0dJL6inu2Z2GTo7nUHP0Q39vvg3ClIAU0V6:ud0zOeu2No70P0mv4Sl2O
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected2024!
Minor OS version
0
Major OS version
5
Entry point
14054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\yexah lapada\rur\na.pdb
kernel32
LoadLibraryW
CallNamedPipeW
EnumSystemCodePagesW
EnumDateFormatsW
OpenMutexA
GetConsoleAliasesLengthW
AreFileApisANSI
EnumCalendarInfoExW
RequestWakeupLatency
GetConsoleAliasW
GetModuleHandleW
CreateDirectoryExW
GetLogicalDriveStringsA
ReadConsoleInputA
FindNextVolumeMountPointA
SearchPathA
MoveFileW
GetCurrentDirectoryW
GetSystemDirectoryW
CreateMailslotA
CommConfigDialogA
GetProcAddress
LoadLibraryA
LocalAlloc
GetCPInfoExA
FindResourceW
ContinueDebugEvent
InterlockedCompareExchange
FindFirstVolumeW
LocalFree
GlobalFlags
GetNumberOfConsoleMouseButtons
ActivateActCtx
SetConsoleCtrlHandler
PeekNamedPipe
FindNextVolumeW
FreeEnvironmentStringsW
GetConsoleTitleA
SetVolumeMountPointA
ClearCommError
lstrlenW
CreateDirectoryW
GlobalFindAtomA
OpenJobObjectA
CopyFileW
lstrcpynA
VerSetConditionMask
EnumSystemLocalesW
QueryDepthSList
WritePrivateProfileSectionA
GetStringTypeExA
OpenMutexW
DeactivateActCtx
WriteFile
ResetEvent
SetHandleCount
FindResourceA
GetConsoleAliasExesLengthA
MoveFileA
GetConsoleSelectionInfo
InterlockedDecrement
SetFileApisToANSI
GetModuleHandleA
GetTickCount
GetLastError
DeleteFileA
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
Sleep
HeapSize
ExitProcess
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineW
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualAlloc
InitializeCriticalSectionAndSpinCount
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
65KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=17, id=149, productName=VS2008 build 21022, version=21022,
count=98, id=131, productName=VS2008 build 21022, version=21022,
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=139, id=1, productName=Unmarked objects,
count=31, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,