Setup.zip
- SHA256 a16651c9afd3eda3a5f29c9be9d57c739bc8bb96b982761163e61b1bfd36d1ae
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NewsStatV2.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
NewsStatV2.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral5
Sample
p2pstate.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
p2pstate.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Setup.zip
- Size 1.3MB
- Sample241004-m9f84avcrd
- SHA256 a16651c9afd3eda3a5f29c9be9d57c739bc8bb96b982761163e61b1bfd36d1ae
- MD5 05985f52b6aa68ae26e6c5cc4d9a671b
- SHA1 1282190b4dcd7e6c277cafb7bfd3535ca697e2d9
- SHA512 2175cdb9b2c8b7419fcfc363817fa0f53269d25d7d0b38f2d27f6fc1f59b7c341186b79c2347ea2cb9fe3a1f06094fbcc23f06d226f66a91ade5d1206db1f0a8
- SSDEEP 24576:Zmm7ot3urRHoBykevlYzH5RIosGBaTCYYea598ZsUE:Zmm7m3HAl4H5RdsMaTCVjbYc
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup.exe
File Explorer
-
Setup.zip.zip 1.3MB
-
NewsStatV2.DLL12B
-
NewsStatV2.ini213B
-
Setup.exe.exe 1.7MB
-
Sеtuр2.0/StatCache.db32B
-
Sеtuр2.0/StatCache3.db32B
-
p2pstate.DLL128KB
NewsStatV2.DLL
- SHA256 472e48643c0b957bb7c612448330f07ce0cb71e14541c6b0b9ce789bc82e91da
- MD5 dc72bdebf3016a463eb4e209af1aefe1
- SHA1 9bde7acc8b748a89daee4d756fa57ce3007e82a9
- SHA512 de6999ebc8dd931a4417c6861e36127a6b7caca1543f1db94eb90c3624045ee57398d2fb1a4841e0647ac0191ab41a04d6dc8642c7f1b888743a03a985c65ea5
- MD5 SHA1 SHA512
NewsStatV2.ini
- SHA256 c16d5f5b6e266ae6321451c7a8d547532cb65e30f089ab70072159b1047c5b02
- MD5 369c4e55c3bbd2fde0057a1001aab99b
- SHA1 c6576a7d886a0c7738b64808988102ae22d7b46e
- SHA512 d42f486318d50898cd6e516f01dcc08e9adc53ba9029e2bd7af263f526b41e7e955e7d33f90300a5c5fa392e5b7336c6e0bcea0169e7877808da63cfdd8cc54b
- MD5 SHA1 SHA512
Setup.exe
- IMPHASH 53f66c8cafe30825839f8a5e9c3bb24d
- SHA256 c4722166ddccf45c4b8760f61326ab4c34c9fe5a4ae23b8c34195b728d19bac3
- MD5 f1bca393ebf7d5de3fc6b0f3b2531a45
- SHA1 e6323fcf662fd477bb3145021495380d1f88d36f
- SHA512 7aab0d2b4cd5608c5caaa8fefdbc39283722b05be9e7e8f0e05e8fbfdcf003d1a2ba0a3dd3afba21e7ad167a2ebbb0603db06d71b74f1dea769cf56082620280
- SSDEEP 49152:bK+/T/rL4gdI+QOoAhKgrqAwHsnxFP18:RQuLF
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
5280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CreateFileW
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
GetCurrentProcess
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetThreadId
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MultiByteToWideChar
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
_strlwr
abort
calloc
exit
fprintf
fputc
fputs
free
fwrite
getenv
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
signal
strchr
strcmp
strcpy_s
strerror
strlen
strncmp
strstr
strtoul
vfprintf
wcslen
_read
Name
.text
Size
271KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
560B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Sеtuр2.0/StatCache.db
- SHA256 6feaca71463ac85e0778ef25c5572c6ab6f04d02a2ce5fa513533933ae7c15ef
- MD5 1dd2d16062a18a70a3cf13fc6073c6ca
- SHA1 192efc58cbd5befcddce69a913ab9a69a9759af1
- SHA512 5f457fbcf37fe54ed2aa761e952d8783a4f138cc5fa2028bf99e8f08f76bacdf8557e1310b03e260982d2ecd99f7e7f9ec2716892fcbb9e72c1886f39e07f879
- MD5 SHA1 SHA512
Sеtuр2.0/StatCache3.db
- SHA256 6a2147d62db884de9f43488c8ffb76648d5985c937fdf261617312df9c0eef58
- MD5 6ff7763ec692b79e38ad1cc00467b109
- SHA1 bf3b027a91fbf63da320da25de1a50bf38acf2a9
- SHA512 295616b279698edcb4aceb64bd7cfe870b748b4c3bdafa6a4c95b39bf15449b33ef5105ef6da5c8ca0b8006dedf4544e3fb6aa1f7bc66e74d5638006651fa20d
- MD5 SHA1 SHA512
p2pstate.DLL
- SHA256 563062fd6c6a2a84ebe6e35e9bb045ef1bc240cdcd20dc557c1957e80ccf932c
- MD5 d4a3019fba1509a1e1faf0115b512c84
- SHA1 cc85bc0017e4e20387c8dd0b1eaff31a5ddb473a
- SHA512 1505c567b1333a02eea5a5356ec0878c87461c22272ea693e651040df59f0677f784248f67c8d5f293be25b746596112bfed61921d6e640887f0955aab23776c
- SSDEEP 1536:cdZTYMYIKPRhJjRn4udcdugdKBH0g01+gZrxtQQzQeWV9JhtgTKzMyLL/gB:ai7ImJjeudccg00gA+AxtErtZvLjY
- MD5 SHA1 SHA512 SSDEEP