Reader.img
- SHA256 d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Reader.lnk
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Reader.lnk
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
red.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral4
Sample
red.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target Reader.img
- Size 544KB
- Sample240909-ybl78swdlm
- SHA256 d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
- MD5 d201bd19e60d500963aff0c235b07727
- SHA1 341552a8650d2bdad5f3ec12e333e3153172ee66
- SHA512 4afa7da1bf2a86dc9a3b94b674ecffea638304c42c43c955631bbe29c605be673b7182ed1fcb8997c55c6bbd2a48e5ec46177e8327e9e903781d1ffb2abd991c
- SSDEEP 6144:h0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:Gzv66zaISTW9asWxxAh4IlXC4PUqBq/
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/red.exe
File Explorer
-
Reader.img.iso 544KB
-
out.iso.iso 544KB
-
Reader.lnk.lnk 2KB
-
red.exe.exe 478KB
out.iso
- SHA256 d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
- MD5 d201bd19e60d500963aff0c235b07727
- SHA1 341552a8650d2bdad5f3ec12e333e3153172ee66
- SHA512 4afa7da1bf2a86dc9a3b94b674ecffea638304c42c43c955631bbe29c605be673b7182ed1fcb8997c55c6bbd2a48e5ec46177e8327e9e903781d1ffb2abd991c
- SSDEEP 6144:h0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:Gzv66zaISTW9asWxxAh4IlXC4PUqBq/
- MD5 SHA1 SHA512 SSDEEP
Reader.lnk
- SHA256 61f36c5ae038faa2b58a9a17b464d01414b4265e46634f353319c471d0a35789
- MD5 66bb9363e23c7ef2d16c89cd654b491e
- SHA1 c20e8d536804cf97584eec93d9a89c09541155bc
- SHA512 b7a751e49218230d574ca9cc4cbbb1995d89798268124b1617889c7558c66902f81fdb77a299edcc6d96452cec81adb76768172710e00c9272d30821ab0089c5
- MD5 SHA1 SHA512
red.exe
- IMPHASH cbe53f46121d600d26965890ee97a94a
- SHA256 45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d
- MD5 71efe7a21da183c407682261612afc0f
- SHA1 0f1aea2cf0c9f2de55d2b920618a5948c5e5e119
- SHA512 3cff597dbd7f0d5ab45b04e3c3731e38626b7b082a0ede7ab9a7826921848edb3c033f640da2cb13916febf84164f7415ca9ac50c3d927f04d9b61fcadb7801c
- SSDEEP 6144:W0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:7zv66zaISTW9asWxxAh4IlXC4PUqBq/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
183268
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
TerminateThread
LoadLibraryA
CloseHandle
GetNativeSystemInfo
CreateThread
SetVolumeMountPointW
GetProcAddress
LocalFree
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
GetModuleHandleW
CopyFileW
GetVolumePathNamesForVolumeNameW
lstrcpyW
SleepEx
GetDiskFreeSpaceExA
CreateEventA
FindNextVolumeW
lstrcmpiW
CreateIoCompletionPort
GetTickCount
lstrcmpW
GetDriveTypeW
GetComputerNameA
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
QueryDosDeviceW
GetFinalPathNameByHandleW
K32GetModuleFileNameExW
DuplicateHandle
CreateEventW
GetWindowsDirectoryW
FindVolumeClose
GetFileType
GetTickCount64
GetCurrentThread
GetSystemTimeAsFileTime
ReadFile
GetFileSizeEx
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
GetSystemInfo
GlobalMemoryStatusEx
WriteConsoleW
ReadConsoleW
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetDiskFreeSpaceExW
SetEvent
GetLastError
Sleep
MultiByteToWideChar
PostQueuedCompletionStatus
GetLocaleInfoA
GetModuleHandleA
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
FindClose
lstrlenA
GetQueuedCompletionStatus
SetErrorMode
InitializeCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
GetModuleFileNameW
GetUserDefaultLangID
WriteFile
lstrlenW
GetCurrentProcess
FindNextFileW
GetCommandLineW
EnterCriticalSection
FindFirstVolumeW
FindFirstFileExW
GetLogicalDrives
MoveFileW
OutputDebugStringW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
FlsFree
QueryPerformanceCounter
lstrcatW
FlsSetValue
FlsGetValue
FlsAlloc
HeapAlloc
HeapFree
HeapReAlloc
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetStringTypeW
WideCharToMultiByte
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
user32
DefWindowProcW
GetCursorPos
CreateWindowExW
RegisterClassW
MessageBoxW
advapi32
OpenServiceW
CryptReleaseContext
OpenThreadToken
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
ControlService
EnumDependentServicesW
QueryServiceConfigW
ChangeServiceConfigW
EnumServicesStatusW
QueryServiceStatusEx
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
RegCloseKey
CryptAcquireContextW
CloseServiceHandle
RegQueryValueExA
CryptGenRandom
OpenSCManagerW
RegSetValueExW
OpenProcessToken
StartServiceW
RegOpenKeyExA
RegOpenKeyExW
GetTokenInformation
shell32
CommandLineToArgvW
ShellExecuteW
bcrypt
BCryptGenRandom
netapi32
NetShareEnum
NetApiBufferFree
shlwapi
wnsprintfA
StrCmpNIW
StrCmpNW
StrStrIW
PathFileExistsW
SHDeleteKeyW
UrlUnescapeA
UrlEscapeA
wnsprintfW
iphlpapi
GetIpNetTable
ws2_32
inet_ntoa
wininet
InternetQueryOptionW
HttpOpenRequestW
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetSetOptionW
HttpSendRequestW
InternetCrackUrlW
InternetReadFile
InternetQueryDataAvailable
Name
.text
Size
325KB
Virtual Size
325KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=30795,
count=179, id=261, version=30795,
count=1, productName=Unmarked objects (old),
count=82, id=261, version=33030,
count=16, id=260, version=33030,
count=18, id=259, version=33030,
count=18, id=260, version=30795,
count=21, id=257, version=30795,
count=221, id=1, productName=Unmarked objects,
count=57, id=264, version=33134,
count=1, id=258, version=33134,