C:\projects\commandline\src\CommandLine\obj\Release\net461\CommandLine.pdb
Static task
static1
Behavioral task
behavioral1
Sample
CommandLine.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
CommandLine.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
max-and-unlock.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
max-and-unlock.exe
Resource
win10v2004-20240802-en
General
-
Target
max-and-unlock_v1.0.0-beta_substatica.zip
-
Size
97KB
-
MD5
45815b5ee4bb6d54baaaed58dcb03253
-
SHA1
b19ffd3b5eacac67023c14d0ebfb71cfb2b9f6d0
-
SHA256
8090b01d56573d5797462d5416e89cad40caf3f7b3423868d0e39c95106b7b8b
-
SHA512
f64f9f64fe8f19adfacf31c3a05372864923fa7add62e46851ec473be0c1203517bafc1a6eaa26cf97d922ce42eeb74ceaf73e155923fcc2e65b6d9f86795a99
-
SSDEEP
3072:pK4FXs8PmCiBAehIuUbe9aUpI9NLK7EaKCeum5golfi5:pK888PmCiBh34e93pITL+ed5gCi5
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CommandLine.dll unpack001/max-and-unlock.exe
Files
-
max-and-unlock_v1.0.0-beta_substatica.zip.zip
-
CommandLine.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 217KB - Virtual size: 217KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
max-and-unlock.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\bro\source\repos\max-and-unlock\max-and-unlock\obj\Release\max-and-unlock.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ