file_c4ccada495ba41cd9a7412cd843be4e2_2024-10-29_06_35_14_035000.zip
- SHA256 bc6ad036e68b3e32361068cabcdf03f13b51963013f6b4e3e42c7831f2f662fd
Behavioral task
behavioral1
Sample
entry_1_0/VIDRESZR.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
entry_1_0/VIDRESZR.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target file_c4ccada495ba41cd9a7412cd843be4e2_2024-10-29_06_35_14_035000.zip
- Size 325KB
- Sample241029-hjev5avlez
- SHA256 bc6ad036e68b3e32361068cabcdf03f13b51963013f6b4e3e42c7831f2f662fd
- MD5 5f7b764a72650922c6f974a7424fccfa
- SHA1 52b157db3d40eb4c06c0d1be0c8cb171e41b51ac
- SHA512 dab69f77f4025f52accad75a6c1b93b48706ed71a3cef8513737ad28e094b0116e975deb7fff4e6e13f10288332ee18795c351a8b644f471ee5da28ec5127789
- SSDEEP 6144:sUX5ljp2wQK0Oo/xhGB2E/6xkLH6CgdVEEwkoxxw3wktrVEmIWf6zHExmEiR:sUX5ljFf0Oo/xhGB2IqsH6CxFPxu3wka
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
File Explorer
-
file_c4ccada495ba41cd9a7412cd843be4e2_2024-10-29_06_35_14_035000.zip.zip 325KB
-
entry_1_0/VIDRESZR.dll.dll 430KB
-
manifest.json355B
entry_1_0/VIDRESZR.dll
- IMPHASH 698be5987d1c6b7cd84c55daa8c43337
- SHA256 b0d501703f77b787f5220241ad67246990b897f6d89a3d88c9ecccd31e9d1303
- MD5 1453760be8a6bb6351af9ae448c5371c
- SHA1 dd8740be7b912297b3b6ea670ae3b6dcbf7f6379
- SHA512 865ea565b4370c442b326fd192fbc99821b68cbc8c427049208657d8a4406f5799ba0dfd699292acd2c1f893eb3425d1baabed54eac62b8f3b375e39ca295186
- SSDEEP 12288:Ku51yhhj7B8DxdqFpS9SsHqCxvPxU3qklu7ei:Ku5o7B6I/+HfxiqX6
- MD5 SHA1 SHA512 SSDEEP
-
Detect Blister loader x32
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
73244
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
VIDRESZR.pdb
msvcrt
??2@YAPAXI@Z
memset
_amsg_exit
_initterm
malloc
_XcptFilter
??3@YAXPAX@Z
_vsnwprintf
perror
free
_ftol2_sse
_except_handler4_common
_purecall
memcpy
_ftol
_ftol2
mfplat
MFHeapAlloc
MFTRegister
MFTUnregister
MFHeapFree
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
InterlockedDecrement
QueryPerformanceCounter
InitializeCriticalSection
LeaveCriticalSection
GetProcAddress
EnterCriticalSection
LoadLibraryExA
DeleteCriticalSection
WaitForSingleObject
SetEvent
CloseHandle
GetCurrentThread
SetThreadPriority
CreateEventW
GetSystemInfo
GetThreadPriority
CreateThread
DelayLoadFailureHook
GetLastError
FreeLibrary
InterlockedCompareExchange
InterlockedIncrement
GetModuleFileNameA
InterlockedExchange
Sleep
GetCurrentProcessId
GetCurrentThreadId
ole32
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
oleaut32
SysAllocString
SysFreeString
advapi32
EventWrite
EventUnregister
EventRegister
RegSetValueA
RegSetValueExA
RegCreateKeyW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
msdmo
DMORegister
MoInitMediaType
MoCopyMediaType
DMOUnregister
MoFreeMediaType
CreateInstance
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_CODE
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
RT_DATA
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
281KB
Virtual Size
280KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=94, id=1, productName=Unmarked objects,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=138, version=30729,
count=61, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
manifest.json
- SHA256 352c4fa05d5e22460c5a402230b20112a562f186dc8e661d9e8764d17c57e8ec
- MD5 5063ae99e355a49c6363e932c94a07bc
- SHA1 2ca89df90a67f96aa969fa8c6d4e64aadbc0db4a
- SHA512 710ca05108d05718cd02352b55a4f9faba79c9840fda45b7af46c4ecf2850c96915a5a4d97de5d4b0362c91c0da0572906cb881ecb36b989b7bd587297cee4dd
- MD5 SHA1 SHA512