itr-save-edit_1-0-1_substatica.zip
- SHA256 d489a45b14bdde1344fd0b9227a0acb5aee1c2f2c94053ad5361fc81ac3665a9
Overview
overview
3Static
static
3CommandLine.dll
windows11-21h2-x64
1CommandLine.xml
windows11-21h2-x64
1DotNetZip.dll
windows11-21h2-x64
1DotNetZip.pdb
windows11-21h2-x64
3DotNetZip.js
windows11-21h2-x64
3itr-save-edit.exe
windows11-21h2-x64
3itr-save-e...config
windows11-21h2-x64
3itr-save-edit.pdb
windows11-21h2-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CommandLine.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
1200 seconds
Behavioral task
behavioral2
Sample
CommandLine.xml
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
1200 seconds
Behavioral task
behavioral3
Sample
DotNetZip.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
1200 seconds
Behavioral task
behavioral4
Sample
DotNetZip.pdb
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1200 seconds
Behavioral task
behavioral5
Sample
DotNetZip.js
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral6
Sample
itr-save-edit.exe
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
1200 seconds
Behavioral task
behavioral7
Sample
itr-save-edit.exe.config
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1200 seconds
Behavioral task
behavioral8
Sample
itr-save-edit.pdb
Resource
win11-20240802-en
windows11-21h2-x64
3 signatures
1200 seconds
General
- Target itr-save-edit_1-0-1_substatica.zip
- Size 701KB
- Sample240930-hstewawdnf
- SHA256 d489a45b14bdde1344fd0b9227a0acb5aee1c2f2c94053ad5361fc81ac3665a9
- MD5 28e0cb72c09aca85362ea96a80ed6411
- SHA1 26c4dbb7c65acff1ad8634a4bf24b3fe1eb4fce1
- SHA512 ecb121422bc79b09965d030c0518fd41cfebb29b5d9eecf65edae18c805b58d81ec42937c144db53245cdbc69e875c40407e96341af3e433d6b5c48da4d562c0
- SSDEEP 12288:i88PJKh34Sk7SVy8YNGY721wDYYsZw7PDw5oCbPpVolU7RzjOtu/1p06tJesGZw5:X8vhOV2heYh7SoehaUdHVTtJvQw5n4w
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/CommandLine.dll unpack001/DotNetZip.dll unpack001/itr-save-edit.exe
File Explorer
-
itr-save-edit_1-0-1_substatica.zip.zip 701KB
-
CommandLine.dll.dll 220KB
-
CommandLine.xml.xml 202KB
-
DotNetZip.dll.dll 461KB
-
DotNetZip.pdb607KB
-
DotNetZip.xml.js .xml 904KB
-
itr-save-edit.exe.exe 16KB
-
itr-save-edit.exe.config189B
-
itr-save-edit.pdb33KB
CommandLine.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2135b40fa819e58cf1942453e4409bfdea2be631077a354b878de8402be7e026
- MD5 2f345b6d207489e52db3f85c2e4e617d
- SHA1 d0cd77aa88b8ed0ae5f07a8132eaca857dea7795
- SHA512 24ad3b3620e5e093ea57c1bec486379853d625dbf962210b2deb823115a45f9ec4083b6d4bb69610a9dae4b6076284c11e3663430db4ea739224e6de93d88e8d
- SSDEEP 6144:sG/zAnUPpKO6acJ8Ha+VbR9HGzIuIliUtf:syzAUPMeaIDGcfi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
230838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\commandline\src\CommandLine\obj\Release\net461\CommandLine.pdb
mscoree
_CorDllMain
Name
.text
Size
217KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CommandLine.xml
- SHA256 5f9dcd98cfe54abdbb21ce39e48dbef6b967b26b23d6c6a71aa15aab2411327e
- MD5 7eab7372442fb1a2891c9b61eabcc747
- SHA1 ba2359c36a498af0e0966c8259572bc23284b417
- SHA512 45badf3dc7e309ea5894ec74fb7e7835d66876d90171255dfe12f79961fc0cca13fe7ac77550562e1347e851bfd04554e616cbc9a46aa1b991a863b8929abb20
- SSDEEP 6144:2ekhEHdRf55OUVXPRrFmRx5x0w3Zd19BVTreE:u+8
- MD5 SHA1 SHA512 SSDEEP
DotNetZip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3
- MD5 a999d7f3807564cc816c16f862a60bbe
- SHA1 1ee724daaf70c6b0083bf589674b6f6d8427544f
- SHA512 6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414
- SSDEEP 6144:DuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:3QL32ikCaUS4csRBse6sfW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
465934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb
mscoree
_CorDllMain
Name
.text
Size
459KB
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DotNetZip.pdb
- SHA256 d4dbeedef2dcdeaa715b88d01c2892d7a5be368908013267958263cf9cdf6055
- MD5 99eb341a214403693aa20cd8b97d54e7
- SHA1 565babcbcd978af66fe1150cc58fdeafc9815822
- SHA512 e797ef990c0a60951ba4ad49467b24173192e71ae5cafbf006cd0e746b63a6f709b3ef70a6f46de3a849c8f5688910b0eced4b26b4f7879e1e53a4c2c5b72ebc
- SSDEEP 6144:rnuVJlDsS91SYAxY5MC/pWNue00vLpkQVHvCJ/lszBn/vPz2G:KQeMRtkJKBn/v
- MD5 SHA1 SHA512 SSDEEP
DotNetZip.xml
- SHA256 51fac9ea9d9b072c4a5deb7e2bf7639cceeb912bea34b563b43b50ba465bcc26
- MD5 e638cb3709cf2cae20fe8c041ae538ec
- SHA1 a7f885327b5b73a29afed883cce75ccda1c6eced
- SHA512 c2bdb01b1cad61e5d2ab8af2b7c848b87f026d1c069bd6a31ccb8d5e87de08823c94d960236deeede48ef490f85b4c0794ca8d32da7cee42cf05badd9c4b465a
- SSDEEP 12288:mf4g/R3NzdqXIf0ALx70XUZrbnN2CDzKjwyKDNctx7/zJRE9B:mffTIhsTczJmB
- MD5 SHA1 SHA512 SSDEEP
itr-save-edit.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 569fac638315d105e25196c47309424819931d49363455abb02735983d1255e6
- MD5 bf1bf622f7c8b584de74375a32788838
- SHA1 50691889fb0982544b6f51b77d1f04753096ab7f
- SHA512 323da08592aea8df237f3056ac1431106936b4849e8c51ae8c960531f189ee2b37dcbadccbac15dda79cfd0fc04c3561496af12d99aa748ed3940d054a282c62
- SSDEEP 192:LRqJ+N/g/jK6mm+NcGEo3ZWjXsJoQ0tbRTlwZ9eirOPtbd75dW1ygHnVDGF/+:Vqfmm4cwEsBA9Tla9hrSfWvHViF/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Development\itr-save-edit\itr-save-edit\obj\Release\itr-save-edit.pdb
mscoree
_CorExeMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
itr-save-edit.exe.config
- SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
- MD5 9dbad5517b46f41dbb0d8780b20ab87e
- SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
- SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
- MD5 SHA1 SHA512
itr-save-edit.pdb
- SHA256 c5dfc89b9baae8ac277e4fb560cf51bae8256a5f8d95aaf14201ab93146cd3a9
- MD5 3aad1b551c5b07f318da48a2d2609d8e
- SHA1 dc2b74ba7e1cc4cecd5475a6685e80fd8f5206fe
- SHA512 63ba7f334ce27eecec4cf582afda95783616ea4196eada4404ad17b46fb6d40521cfc987de2379936d81a7511398e3543502afe2099a7033ac226f50b82ce391
- SSDEEP 384:gmfrfRiC3CfY8OdRrqxDW7gVjRH+Wgz+:gmfrf/CfY8OdRFCRRgz
- MD5 SHA1 SHA512 SSDEEP