Netflix Valid Email Checker.zip
- SHA256 5cf1dd4e1137cbdf404266cf62fae5fd1eb59d07afa69a7bfb02c2243fa5ddfc
Overview
overview
10Static
static
3Extreme.Net.dll
windows7-x64
1Extreme.Net.dll
windows10-2004-x64
1MetroFrame...gn.dll
windows7-x64
1MetroFrame...gn.dll
windows10-2004-x64
1MetroFrame...ts.dll
windows7-x64
1MetroFrame...ts.dll
windows10-2004-x64
1MetroFramework.dll
windows7-x64
1MetroFramework.dll
windows10-2004-x64
1MetroSuite 2.0.dll
windows7-x64
1MetroSuite 2.0.dll
windows10-2004-x64
1Netflix Va...v2.exe
windows7-x64
10Netflix Va...v2.exe
windows10-2004-x64
10Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Extreme.Net.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Extreme.Net.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
MetroFramework.Design.dll
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
MetroFramework.Design.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
MetroFramework.Fonts.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
MetroFramework.Fonts.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
MetroFramework.dll
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
MetroFramework.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
MetroSuite 2.0.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
MetroSuite 2.0.dll
Resource
win10v2004-20240730-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Netflix Valid Email Checker by X-Splinter v2.exe
Resource
win7-20240705-en
windows7-x64
38 signatures
150 seconds
Behavioral task
behavioral12
Sample
Netflix Valid Email Checker by X-Splinter v2.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
38 signatures
150 seconds
General
- Target Netflix Valid Email Checker.zip
- Size 1.8MB
- Sample240731-p7lrxathnp
- SHA256 5cf1dd4e1137cbdf404266cf62fae5fd1eb59d07afa69a7bfb02c2243fa5ddfc
- MD5 a8ff2fc3b3d8cb158ef4b3e62f252055
- SHA1 bce1e7bf0dab25dea26ae8170fb1f43436061bea
- SHA512 1abc984113f63e51db7c87ce54ef7863523bf22ef549ac23f02183e1970a1ffcac50f8aecaf96b8e8d259e28c8302f662dd1f7812c5efcb5496ec0395a5594b2
- SSDEEP 24576:XbCNr5L9wdMm67zifwBtIuoJosWeh0PLi2+F5Byd9I2Ufo2134n5E/CqHx8VdLtL:Xy5qMzzNBdoNhYr+HMbI2Mo216y98Tx
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/Extreme.Net.dll unpack001/MetroFramework.Design.dll unpack001/MetroFramework.Fonts.dll unpack001/MetroFramework.dll unpack001/MetroSuite 2.0.dll unpack001/Netflix Valid Email Checker by X-Splinter v2.exe
File Explorer
-
Netflix Valid Email Checker.zip.zip 1.8MB
-
Alert.wav908KB
-
Extreme.Net.dll.dll 121KB
-
MetroFramework.Design.dll.dll 16KB
-
MetroFramework.Fonts.dll.dll 656KB
-
MetroFramework.dll.dll 313KB
-
MetroSuite 2.0.dll.dll 305KB
-
Netflix Valid Email Checker by X-Splinter v2.exe.exe 976KB
-
netflix.com.txt1.0MB
Alert.wav
- SHA256 ad199b19ea78ae3871c037e1a3d5a8feb5bf6286a6a300b1e0993ba0ba15220b
- MD5 9e740aaa2dc47101c4edbf00dac7066d
- SHA1 a085cff9840bb125cb70d344792d93d1ebb7d7c2
- SHA512 27de18ff313a8d98cd2f22db29a2c0448b3566ebfba5359a0fa08feccf3f24c814e7c219b92e2fbf45b6ea81d190f7c72680c97aff21e0e5db4fdb8e70905d37
- SSDEEP 24576:TIiyySdojb5JtjgXoOCiRUTzhQvIx03yHa7S2:FyXdo5jgfR0zigev
- MD5 SHA1 SHA512 SSDEEP
Extreme.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8a6518ab7419fbec3ac9875baa3afb410ad1398c7aa622a09cd9084ec6cadfcd
- MD5 f79f0e3a0361cac000e2d3553753cd68
- SHA1 4314bcef76fddc9379a8f3a266b37d685d0adb79
- SHA512 c77516e7f5540ecd13fa5d8cecfce34629acecd9b5a445f5f48902c9e823328fa9a6694ecaa39f5b6053de61c2b850c2d87df25357548afaad6ec37eb3e5e355
- SSDEEP 3072:bdoECIgjBibgp2tBqL0Y++ruXqMG4ih3lbpMqc:bdoECIgUrG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
129182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\scarf\source\repos\Extreme.Net\obj\Debug\Extreme.Net.pdb
mscoree
_CorDllMain
Name
.text
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MetroFramework.Design.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 28089707733c92c7fade97e7b6fab4007e7b8bfd6dc7a8526a3ea597f1a30845
- MD5 c853e9e8c720249198ff376f42328ef9
- SHA1 a56ee195148023571e26ffeaa5a736bc73a76c40
- SHA512 d21cf5cfe0a5e2f7d4c128e64e0decee28028297c804319fb957b1f0e60d62e3103976b95abc3d2bd5ba66801cb5fe9bef4bae067273079177be28c73132c739
- SSDEEP 384:k1q4fJwcRJTxK0JLBamLGqPkO9V1VFf5L7W1OYKjbq9w:6q4hwcRBJLBamSqPkO9V1ViGq9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\VB\winforms-modernui-master\MetroFramework.Design\obj\Release\MetroFramework.Design.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MetroFramework.Fonts.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 15a605129cac3663ba1ddb98f5798334fba5e7954ee36a69727299b4e366c2eb
- MD5 b8c8a532438c4b421081efb258355469
- SHA1 41aa88d5eaf398da55f712f30226b70492125be1
- SHA512 511070c8cfe018e60e11d495393152e10aa2aa0c08cde84678ef3a0efd63ae5c562a47bfab883f4babd469b1873127bacc9c986cb2bc096985176f1dbf93b1fc
- SSDEEP 12288:5+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:5+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
677454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\VB\winforms-modernui-master\MetroFramework.Fonts\obj\Release\MetroFramework.Fonts.pdb
mscoree
_CorDllMain
Name
.text
Size
654KB
Virtual Size
653KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MetroFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e58f13deb328455f216f165588b5f5111ecd12042d7dd196686dfb0f0fc68eb
- MD5 b20f1b5e3d4e3df2d826e9870637cd06
- SHA1 a03bb47afdf9498be409ed5b56e945f6e143fb32
- SHA512 095c5956ebc114c4b380d2b43981bcabd221782530328a51cb2c6aec05a016dad2e5efae36810f6840611f77f589be1e1e7f2200738df3bca222381837033b2d
- SSDEEP 6144:Ys+J/PxfbpAQ1bZHE7Zhm6uOw0g749O2:qJ/PxzpAObhV6uO99O
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
326366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
311KB
Virtual Size
310KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MetroSuite 2.0.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8604bf2a1fe2e94dc1ea1fbd0cf54e77303493b93994df48479dc683580aa654
- MD5 0d30a398cec0ff006b6ea2b52d11e744
- SHA1 4ceebd9c6180a321c4d4f3cfb5cfc3952bf72b45
- SHA512 8e06ff131a81e73b1ff5de78262701a11ecc2bcdaf41011f4e96f11c5372742478e70b6a0901b61953c21c95725532af8d785654405ec5066ad157e2143467cc
- SSDEEP 3072:K6J2UBugOAI+yjNDWswy1MNo1EvnvkgvloSVQBjDifX0pPSRZ9KZdf8uvqtXfZBF:K6Jr8xhFzfOaa3xqQnQGTO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
305726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Martin\Documents\Visual Studio 2013\Projects\MetroSuite 2.0\MetroSuite 2.0\obj\Debug\MetroSuite 2.0.pdb
mscoree
_CorDllMain
Name
.text
Size
291KB
Virtual Size
290KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Netflix Valid Email Checker by X-Splinter v2.exe
- IMPHASH c8af21d27e764744732a1d8ec3a217aa
- SHA256 ee5db783f4fcaa53ca4babb8ddb6c143bf34307af0e1f7be9912494c5d071aae
- MD5 1a4da925d3cfef0f8040ad9858133181
- SHA1 e912d052c7d778eef4a3ab320d8c9e8d905147be
- SHA512 e1ec260669e3f89a9479245dacce1b5b7550ddca437572d69516335575543d138924adffec4202e147347f5cc8fb0c365de83383df5fb740dbe32b8f21eb8a54
- SSDEEP 12288:BiUE6zr+B8DY9yYhaODRgDKqHgo2aqNUazcKhhhhTGyRYpYqh:AUEyavaOWuqAxa+vYl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
19075
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shell32
SHGetFolderPathW
kernel32
SetLastError
HeapSize
WriteFile
CreateFileW
SetFileAttributesW
Sleep
CloseHandle
CreateProcessW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
GetProcessHeap
RtlUnwind
RaiseException
GetLastError
WriteConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
793KB
Virtual Size
796KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=259, version=30795,
count=169, id=261, version=30795,
count=21, id=260, version=30795,
count=21, id=259, version=33731,
count=18, id=260, version=33731,
count=5, id=257, version=30795,
count=101, id=1, productName=Unmarked objects,
count=77, id=261, version=33731,
count=1, id=265, version=33812,
count=1, id=255, version=33812,
count=1, id=258, version=33812,
netflix.com.txt
- SHA256 7da3d6f9a9941b8e2b2860a46de08fce3c3dd4c038e0076f230c103bc5c3680f
- MD5 3bf53e283220787db3d719e6b2a897c0
- SHA1 835a8e12a20101c7ba3458407751303b01a779e7
- SHA512 d21e9e812e07c70b11a7e9d84a6f29e791340af5fbb81ca24bdb50195eba43d9f40b2af09128b8f3bfd75bdb84b65ca690d471768da0cb4bbd6a869a80bd9581
- SSDEEP 12288:uzT/O366KCQ5L+i2juV5ElXjqEvYSx33KeKLdjoAvFf:uzZZRbcXjqtsof
- MD5 SHA1 SHA512 SSDEEP