test.zip
- SHA256 ea9df543b10ca5df71859a023c71dc2f3ba731554615806fb5d3ef7f667870e7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
test.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target test.zip
- Size 30.5MB
- Sample241105-3x67rasbpn
- SHA256 ea9df543b10ca5df71859a023c71dc2f3ba731554615806fb5d3ef7f667870e7
- MD5 7beed48971f983858d0364ab70495207
- SHA1 0c8324325b4366df84a4e5b13f6890af41c81615
- SHA512 c5775ef536ed644ef50bfc09037f9c0fa174eae81ed78377b57450ce9097917aefceeb22270d74e7105ebef295f7a0b27ba1389cb2e9193c73e2799eaf310265
- SSDEEP 786432:xFGbMWAPeg+EIlvRX/dVAb81e/D74XXRKEKnt6nW24VQtFuD:fGIPeg+RlvRvdV48ewXyntuwetFuD
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/printui.dll unpack001/printui.exe
File Explorer
-
test.zip.zip 30.5MB
-
printui.dll.dll 91.9MB
-
printui.exe.exe 62KB
printui.dll
- IMPHASH f001433c206810587a639970e1a19a24
- SHA256 b885af7647ee04128fe056c378b088fd2612e8b6c2d8f755292abb666099a0cd
- MD5 8ea6df95c6e1b5d3e17f84e698713703
- SHA1 e7e5267082d4011555b5eb011bdfce9d67d226f9
- SHA512 9f3b1bb43d7f6fa5e9c46bec66712bb0851bacdd5e956cbf793e80e6e19a1bfa4d7b8fc5a6e07fb10dcd6e271d34e332a7220cdf44566cf50b56effd30f1731f
- SSDEEP 393216:DswMHrRKNwF6j7f4cYyFhgM3gOOyanVqvA:Dr2DYUcFgMwOObnVB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
fwrite
api-ms-win-crt-string-l1-1-0
memset
strcmp
strlen
strncmp
towupper
wcscmp
wcscpy_s
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
DllMain
PrintUIEntryW
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
13.9MB
Virtual Size
13.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
78.0MB
Virtual Size
78.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
94B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
printui.exe
- IMPHASH de8c59512ca98fb3e224769147985370
- SHA256 53db039d9d46f2f3f80df42c8ba48bb96ce4fb96c1bfce5cd61514a7ff369411
- MD5 e43252474adf63e69b1fc65d202d88c3
- SHA1 b1fcb1ee3cf86816ce749e40127329fc857a67a6
- SHA512 7272f811056e17dd2b909241b32f7fa8dece0b35c88657277caf88ee217bfb5d87ba3895509aed3c4665adf506acf55b6cb8c2d84f1f26f40c806a900e9b1260
- SSDEEP 768:a4IHmXrH6otqKYI5vI1iQfCIWVM9G4qW4ne+S/ly+PKAoXRZX6fbX57UWkCRPPAu:CcaXKdVIPd4n+lbeRZIbSQPPA7K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
6112
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
PrintUI.pdb
advapi32
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyExW
RegCloseKey
kernel32
HeapSetInformation
GetProcAddress
FreeLibrary
GetCurrentProcessId
GetLastError
GetCommandLineW
LoadLibraryW
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
gdi32
GetStockObject
user32
RegisterClassW
CreateWindowExW
DestroyWindow
DefWindowProcW
LoadCursorW
msvcrt
_fmode
_commode
?terminate@@YAXXZ
__C_specific_handler
__wgetmainargs
_amsg_exit
_XcptFilter
iswspace
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
memset
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
216B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=27412,
count=2, id=259, version=27412,
count=17, id=260, version=27412,
count=13, id=257, version=27412,
count=54, id=1, productName=Unmarked objects,
count=2, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,