CommandLine.zip
- SHA256 90faf31995ab565fe749d3b2ae4d02632b108f212bcdda99638d774cd4b6c9d9
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AutoInstall.bat
Resource
win11-20240508-en
windows11-21h2-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
CommandLine.exe
Resource
win11-20240611-en
windows11-21h2-x64
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
Commands.chm
Resource
win11-20240419-en
windows11-21h2-x64
1 signatures
300 seconds
General
- Target CommandLine.zip
- Size 48.6MB
- Sample240613-31e8fazfpp
- SHA256 90faf31995ab565fe749d3b2ae4d02632b108f212bcdda99638d774cd4b6c9d9
- MD5 022a4f870458d128b91b998ae9dfcb98
- SHA1 37c1a2c1f76343ff11e4491a765b2d266fa6332e
- SHA512 b4b5c063328db0e1b4bc8124cccb218e9fd0856e4f0499befef22dbdd317dad55bd5dd77664f069bfe047a959d93df8f5295a6c07dfb9e54272a8b61989b4412
- SSDEEP 1572864:t9AjOc5kpYcMuowxrLKozrMIg/Gzd1LgXMP+:t9Ayuk2W5rMIg/21LmMW
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CommandLine.exe
File Explorer
-
CommandLine.zip.zip 48.6MB
-
AutoInstall.bat182B
-
CommandLine.exe.exe 51.6MB
-
Commands.chm.chm 26KB
-
License.txt1KB
AutoInstall.bat
- SHA256 c0f77a4a8363707b252eead4e8a6c24ee1745d35383dc5247d6c19fbbc90b3f1
- MD5 469a1bde70c70c9d415c6c2bfcd1cb7f
- SHA1 e51f2a04100672a6b0348b6ad999080ff806d0fd
- SHA512 d3a08ca84ef23f3e865383b01f84ba74e95792a4924a39360e83063a44199062408ecc51ea3510c3ef1decda9515f99df2b9fb855b00fa9b459ac883378af437
- MD5 SHA1 SHA512
CommandLine.exe
- IMPHASH 838dd9fbdbb409224ad0e13122a109ae
- SHA256 6a82152992020dcd185d7a52cffac8ab63278c53430750cb21c52697c619e536
- MD5 7e58e18cf6a0d332dafbc05f95952f54
- SHA1 356c8843b342dfea946d98bfd54972bc5a641651
- SHA512 1ca694bdc9f80a884f8e522a210f5366efc6d6b71decd302231aa02d9f756050b6a1097486c6a3214e8c94a008a3f1ece2dc1a299e14c8bc6993112bfd20e952
- SSDEEP 1572864:jeyj8XKQGQkejX7uGzv+sU56tpnD0tm/V:yq8asJv+sU5snDQmN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
12316
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
LoadLibraryA
lstrcpyA
lstrcatA
lstrlenA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
_lclose
GetModuleFileNameA
_lread
_llseek
_lopen
_lwrite
_lcreat
CreateDirectoryA
SetCurrentDirectoryA
GetDiskFreeSpaceA
GetFileAttributesA
CompareStringA
DeleteFileA
GetTempPathA
GetCurrentDirectoryA
CloseHandle
GetExitCodeProcess
GetLastError
LocalFree
GetCurrentProcess
MoveFileExA
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapReAlloc
HeapSize
IsValidCodePage
Sleep
RemoveDirectoryA
FreeLibrary
GetOEMCP
GetACP
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
RtlUnwindEx
WriteFile
GetStdHandle
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
user32
TranslateMessage
DispatchMessageA
PeekMessageA
wsprintfA
LoadCursorA
SetCursor
MessageBoxA
MsgWaitForMultipleObjects
advapi32
GetTokenInformation
OpenProcessToken
shell32
ShellExecuteExA
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
990B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=63, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Commands.chm
- SHA256 2f7c20bf797fb5b11b07711328b596aea1c510473fba11836e331c2e8c6382f8
- MD5 cafa11f04c69f19b39e18dcb8d709371
- SHA1 dc6d85034d3d983fe4284e7193c0e12685f680aa
- SHA512 d77a6c8507698f89c0991e42f2d09ef159e3f8478c0fef829599f3635450bd842be0d3c05539d648c38e3d83e236d07cf539e3e9ac8875375ef610767afa2a5c
- SSDEEP 384:mOV2mGPeDqSCqKe+9GbMUeaEyJy6r/UkxTDVQaAEakE42Jq1U:mOV2uDqZ3Ab1ev0/PtDVbA4D2x
- MD5 SHA1 SHA512 SSDEEP
License.txt
- SHA256 e4c132d73232040f31a72fcc4773269f09eda3deb4db8ba18fc4ec406c7093e6
- MD5 c3c1796625a956f68a6d5409a3036e57
- SHA1 c3a564630c076f0da39d8ea9396d4508f6e6af2d
- SHA512 19adc93ad1449fad169f91bf3641eb024ee3392053df84a35d9015fb5155a9334fd00229395012f48748390c8f73fb0b3eeb0e7f3b7acbd6114ad21ef35507c0
- MD5 SHA1 SHA512