SpyNote3.2.zip
- SHA256 b6dcf2a38cec43f07050e35bbfddcdfb7f849ac511263045f0dd05fd2dca7808
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SpyNote3.2.zip
Resource
win7-20231129-en
windows7-x64
0 signatures
1800 seconds
General
- Target SpyNote3.2.zip
- Size 8.0MB
- Sample240603-j8e3vsac26
- SHA256 b6dcf2a38cec43f07050e35bbfddcdfb7f849ac511263045f0dd05fd2dca7808
- MD5 e906bff442b92771eae5e1cb67213dd5
- SHA1 ed4528c96eae957f1b1d364d6f164b20ff170d5b
- SHA512 d8eb56cbcabf3abf0a79da7291c9a176e24a9f812d47f1838a8f72963dfe21d8bdffba33a57a7af168a52cc40dbdfea04742fe0647abfcb8cae979d73c488605
- SSDEEP 196608:mDz8p3CZJlwuusLdBjA/p8z6FgNH6r/3NZPjHci:mDeSZHLuWfjAK6XvjjH9
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/SpyNote3.2/AxInterop.WMPLib.dll unpack001/SpyNote3.2/Interop.WMPLib.dll unpack001/SpyNote3.2/SpyNote.exe
File Explorer
-
SpyNote3.2.zip.zip 8.0MB
-
SpyNote3.2/A-Emportant.txt1KB
-
SpyNote3.2/AxInterop.WMPLib.dll.dll 52KB
-
SpyNote3.2/Interop.WMPLib.dll.dll 323KB
-
SpyNote3.2/SpyNote.exe.exe 9.6MB
-
SpyNote3.2/bWFlcmNz.jar.jar 6KB
-
SpyNote3.2/c2NyZWFt.jar.jar 16KB
SpyNote3.2/A-Emportant.txt
- SHA256 e7e54eb60c8f6f79fbd0ee34c4124c2e207963fc9d40d6b7e715d79aec368e77
- MD5 708b8ba5fdc34c844f1c35618484ebc7
- SHA1 bb72b0adef3409ef60108fa37f83e481ef870de0
- SHA512 c7255ee4039820b6c8a57fba9cb51a431dc18ebe82d1351350df5417cfc6afcfb4cf2e6c8a0e792211cca802d7dac29590da5a39c512df4dcb0615aac3494349
- MD5 SHA1 SHA512
SpyNote3.2/AxInterop.WMPLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 37164ef84a18ee486eb83960533dbb78557912e42671756bb6b97a40cab2e789
- MD5 118ca4d0ed457048379a03266cf2e005
- SHA1 0191bb7c416cbc6966058f0b7786443a9c340265
- SHA512 e08065cc1920661f960703a9f19052fd728685a473cce555cb0d3e3d90d49b47bd977b6336d6819ede4690f3c29b3fc2d34d223e23ad41f0ba0eefcdd7e0c55d
- SSDEEP 768:dTiglqcPGmH+BSITBFo+iRdbBFS1WSbfi5qlD+P2mHvaVhXUWdYVXnI:YgvH+oETfiRnFS1WSbfi5qlsaV2WGtI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
59422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
712B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SpyNote3.2/Interop.WMPLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 808d5df92a75659fcb964b8fd6d256d8a6f0bb795264f9692825e319a4da8b2f
- MD5 fbf343e74eb2c08ba9a8139755b5cc23
- SHA1 59bfed288dae4873e7a018f30a99b95a964360ea
- SHA512 dd40d32c439d3272b8bd7721602a9d2d293357655d7c384bf49a13439317e4ae0610d9563c38d7fbbb66b57598c2fb4ad22927d5f4d7db5c9f581a4fcc128fad
- SSDEEP 6144:gsJi3gtWLExqLsY9jAaRgHuF07yp4f29sTahwXeVELC5IvmN8jqxAnOlUbSJY/WR:gsJi3gtWLExqLsY9jAaRgHuF07yp4f25
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
336942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
321KB
Virtual Size
321KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SpyNote3.2/SpyNote.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 efa0633c7b7b7c8012d853497ca3801613d7e2a39fd810ac63e78fd8c6d4b346
- MD5 16ed5acdb6fb85633bc88b465195eee2
- SHA1 8cb34bc98ed08694194c42074ac33e2d30b8051d
- SHA512 aaa4819257eaf45518466a742692bfef99e29dfef6429a2a30647166899ad5143d1cb54577d7c9fd38af5ad9ac28ebf14b8c11e2baef0b25862bf889c4293479
- SSDEEP 196608:RHWTv9sJi3gtWLExqLsY9jAaRgHuF07yp4f29sTahwXeVELC5IvmN8jqxAnOlUb1:u9sJi3gtWLExqLsY9jAaRgHuF07yp4fF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9929926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\scream\Desktop\Gen\Gen\obj\Debug\SpyNote.pdb
mscoree
_CorExeMain
Name
.text
Size
9.5MB
Virtual Size
9.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SpyNote3.2/bWFlcmNz.jar
- SHA256 a055be0976d29d43c2d28e8b9c0c58720a93959abfc32b620f0296dfac47b042
- MD5 5b7e048d2cfbcceadeadc314b0c24d8b
- SHA1 01867e2d3e45e76b71ddcd223586f544ccf958ba
- SHA512 c4e0dfbc9c60163f74327b6abbcb1408cc89fb26ec70313dac9f7c5d21ef011335c115682afe5fdf407666af19355119b3031f3f12aad9b47665b40345985b31
- SSDEEP 96:n/83IlegJGlFl2IlU7sO0EFlcZD8RiAHwPe6tp0YXdY8xSZe7zca:cIlegJGlH5U5l0n264eSs7zca
- MD5 SHA1 SHA512 SSDEEP
SpyNote3.2/c2NyZWFt.jar
- SHA256 7b036f9e0fd5f750dc27b60c421159f77bffd45ca59ac54c154ab7b106cceff6
- MD5 4dc441c13e425380876f7b443f615d47
- SHA1 51007970637b4df2bb77af3c9fd378f8dc8fb7a7
- SHA512 36d1fd284e030b248ff32706204687480582b84360368a285b67c3e62b10d8fd90b289dbca85cb33b35cb0848ac0145418c188eeb7f4a918f0b34697a96483d8
- SSDEEP 384:HU1Md6CZTb/bkEH+qLMd62aFIl8lGjtdZefTKbEDU5A52NqzKXgoWg9zQFCcGJJ:HU1Md6uzkEHZMd62aXYj3ZefubEDU5A6
- MD5 SHA1 SHA512 SSDEEP