RC7.zip
- SHA256 dcaf229e56e1b0f267d7e99b63920150ef1c18f8bcbf4da94c9ac592c75bdbe8
Password
sn#C'e?07V7P
Overview
overview
10Static
static
3RC7.zip
windows7-x64
1RC7.zip
windows10-2004-x64
1RC7 (5) (1...s.json
windows7-x64
3RC7 (5) (1...s.json
windows10-2004-x64
3RC7 (5) (1)/First.exe
windows7-x64
1RC7 (5) (1)/First.exe
windows10-2004-x64
1RC7 (5) (1)/First.exe
windows7-x64
1RC7 (5) (1)/First.exe
windows10-2004-x64
10RC7 (5) (1)/First.pdb
windows7-x64
3RC7 (5) (1)/First.pdb
windows10-2004-x64
3RC7 (5) (1...g.json
windows7-x64
3RC7 (5) (1...g.json
windows10-2004-x64
3RC7 (5) (1...ME.txt
windows7-x64
1RC7 (5) (1...ME.txt
windows10-2004-x64
1RC7 (5) (1...ET.dll
windows7-x64
1RC7 (5) (1...ET.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RC7.zip
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
RC7.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
RC7 (5) (1)/First.deps.json
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
RC7 (5) (1)/First.deps.json
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
RC7 (5) (1)/First.exe
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
RC7 (5) (1)/First.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
RC7 (5) (1)/First.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
RC7 (5) (1)/First.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
RC7 (5) (1)/First.pdb
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
RC7 (5) (1)/First.pdb
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
RC7 (5) (1)/First.runtimeconfig.json
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
RC7 (5) (1)/First.runtimeconfig.json
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
RC7 (5) (1)/READ ME.txt
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
RC7 (5) (1)/READ ME.txt
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
RC7 (5) (1)/ScintillaNET.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
RC7 (5) (1)/ScintillaNET.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target RC7.zip
- Size 1.3MB
- Sample240804-3war6avale
- SHA256 dcaf229e56e1b0f267d7e99b63920150ef1c18f8bcbf4da94c9ac592c75bdbe8
- MD5 ba1d173c86f1757d5afd626ac8654a46
- SHA1 ad5a96395c1856976ccc21a5475c8abee46a7395
- SHA512 4f5bd6c43004e5daf86e0a9353821b8e55c735a9318ba035db36221387024645a0c5418bd9ca1ab21cb2130e1893650abafa6ea081b5cb82396201d376783208
- SSDEEP 24576:jC3aGYqXtuh05vkLFz/cQO9JLyxa47UI4Gp+visFLfd++NYd++2MwvesVdRLFlr:EYT0iLBYJia4734GpUzd++N7HTjlr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/RC7 (5) (1)/First.dll unpack001/RC7 (5) (1)/First.exe unpack001/RC7 (5) (1)/ScintillaNET.dll
File Explorer
-
RC7.zip.zip 1.3MB
-
RC7 (5) (1)/First.deps.json407B
-
RC7 (5) (1)/First.dll.exe 7KB
-
RC7 (5) (1)/First.exe.exe 139KB
-
RC7 (5) (1)/First.pdb10KB
-
RC7 (5) (1)/First.runtimeconfig.json268B
-
RC7 (5) (1)/READ ME.txt506B
-
RC7 (5) (1)/ScintillaNET.dll.dll 1.3MB
RC7 (5) (1)/First.deps.json
- SHA256 13b10c533eafa0a1111ee62f978d4407bad2e5efe86c1d11cb1ef07d67796fd8
- MD5 1c6af07f5e054bc005f172fa8487c5ed
- SHA1 4880dd8a6e9b72809b1bbd36bf679690ac9c7931
- SHA512 24e4099df987b8a9170220d2d58e4bafc72927ddf07b7dd0b400f8b8f416501d112cdb8fd6d7968025d02090e5bf6f8e9ffa4e4cc785fbc5175fbd160d0c46ac
- MD5 SHA1 SHA512
RC7 (5) (1)/First.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 77ea5129b0e8145f00c040a5a7db84b37d6b736f488e866545ae072ad9ca221a
- MD5 64fb3c0c1269bdb3119d0aeca9783c69
- SHA1 39903892a687e03aebfd1de9c407e724bf5024fb
- SHA512 22565870393c6353591bd2eabc9748e269704277bdb1df7faaa99564ed78988a455df4a515de8231cbfa6655ea3eeabd137fa2fa0b162132d6e08fb329e5381b
- SSDEEP 96:rddBmJWilc/5eFLxHolIOCcmMdPpkwWNFRR1X+W6FnCSHN/CNVWzwkSTozNt:pyJpieF9Ho0cm69TCekpq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
sn#C'e?07V7P
Minor OS version
0
Major OS version
4
Entry point
13034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\broid\source\repos\First\First\obj\Debug\net8.0\First.pdb
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RC7 (5) (1)/First.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 8bcb2329f01af33a1707f6a1a749987cfaff3976a9bcdbffad37d477dd5fd8ab
- MD5 d5f71f93624190439b569498acca69a9
- SHA1 323c616a5ed5e680b221f1db6acfa222e8be719a
- SHA512 e03043bbd4389f77d337a33d92764496bd5a84654a95a3792de0a025765d43a795ef1351a64d96c6ae1f85daadc68a1c1fdc192a9adb153a15cf1cb71607b715
- SSDEEP 3072:+iS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJK8ltX:+iS4ompB9S3BZi0a1G78IVhcgct
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
sn#C'e?07V7P
Minor OS version
0
Major OS version
6
Entry point
70496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33218,
count=18, id=259, version=33218,
count=86, id=261, version=33218,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33519,
count=1, id=258, version=33519,
RC7 (5) (1)/First.pdb
- SHA256 5212b77b76e6b7e56551074c424a56d0c03d4e0fc8502dd836fa5c2627b1d4a6
- MD5 9b443e924bef08f021422fdc1a6edde7
- SHA1 216e925a96f92827efac247904ba97343be57c1c
- SHA512 88162989db275d77bff04a9a0262d534272be23db430fdaa86321ff25780ed61c6aa256b69d6ceda958ca371f631fb8b9563df4ae144ad8d1c983b95e90941d6
- SSDEEP 192:4MocM3yCgLm/cXpCZbd+auMDDtSbrUvT+TUgVhkXIh2/8tLcwkQH4raayHVfIUXJ:4MxErgCZbd+auMDDtSHaT+1VhkXIhvt9
- MD5 SHA1 SHA512 SSDEEP
RC7 (5) (1)/First.runtimeconfig.json
- SHA256 162d81f468bec570ec15e527433f4de5d5729ffe338ab79b22671f38760d34bd
- MD5 9fcdf880f73e74cf6347f8194b9f3509
- SHA1 ab571c7ed4920129c89c7e083f3c9f22597198bc
- SHA512 23ea2a78914aeec443bded1e6dddb1fce61f0445c53e0428e97353dcc25e9ee80a98603069de336d57c1d12b00eb14ad59847137387df330a3925bd763f4fde1
- MD5 SHA1 SHA512
RC7 (5) (1)/READ ME.txt
- SHA256 ee8e08bb7361c78544257c320d90767e7c32b6b30fd196283f0426a6d1c316d9
- MD5 8be52f0bed378536eeae278d8cede262
- SHA1 f70451795b80a21271b94dbfb4476f6def3ca27d
- SHA512 7d8e01ca909659e39a2f3a49e550f020db2210b8dc8b5f5fabddce30c226e3740ee59a53a941a45b3f1932e6d50d7e781b4e3de94d1d8e92f0a9bcb9043c9e89
- MD5 SHA1 SHA512
RC7 (5) (1)/ScintillaNET.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
- MD5 9166536c31f4e725e6befe85e2889a4b
- SHA1 f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
- SHA512 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562
- SSDEEP 24576:IJSShz305vgNF7/cOCPHPSVs4Eq+QTNX+cfQdS+2MMPishd/Ws5:ti0aNvoHqs4L95X+cfx/HGC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
sn#C'e?07V7P
Minor OS version
0
Major OS version
4
Entry point
1373218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\jacob\Documents\Projects\ScintillaNET\src\ScintillaNET\obj\Release\ScintillaNET.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ