NinebotIAP261.zip
- SHA256 a993d42feda9a082384565de8e5916086701f46bf77017f8f8bddd0f4e779a35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
IAP.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
System.Runtime.WindowsRuntime.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Windows.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target NinebotIAP261.zip
- Size 3.7MB
- Sample241109-2qvdyasrew
- SHA256 a993d42feda9a082384565de8e5916086701f46bf77017f8f8bddd0f4e779a35
- MD5 8113527b3a4d14a919b037a29c3e8bfc
- SHA1 9483281e36352497c13061ffed8317186d87f340
- SHA512 78f0cf6f19265e8d904c331adf7517a9ff0c68f0b0e96064a3f9f02e3b8465a8234525e4c00a5ceb3aace8a877a81d3286522fdeee7ef89704af6751996612f0
- SSDEEP 98304:bTEXKRzWZCzee/XU7AEVbYxxpTD+UNGt4ZE3VkAS8b07dh:caUUzB/FEqpXLm4ylpbidh
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/IAP.exe unpack001/System.Runtime.WindowsRuntime.dll unpack001/Windows.winmd
File Explorer
-
NinebotIAP261.zip.zip 3.7MB
-
IAP.exe.exe 1.9MB
-
System.Runtime.WindowsRuntime.dll.dll 156KB
-
Windows.winmd.dll 6.6MB
IAP.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c4928e33e4697295f144cde80520c95254f9f0c495fae866a894d7200cd60232
- MD5 109ceb92fb50b1951138d5a44c3da5d5
- SHA1 714f21175e70ca2678b9befb1f7323bb82a16f8e
- SHA512 23c7532abb8de75b99f7a08ed945bfffc0d7df54bc4bada71da10ce950f3a6254fb7c539bd48a4b6c9441ee40754f20863fe41f36367a2376fb6c442cc784f66
- SSDEEP 49152:cKlynLBjkNE3vbsZiywZSKxVXNLj4W8gS+r/NRu46XZ13:NOqNGTsZCN1GgSuRu1Z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1998858
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
>I0<|6
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
53KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
dotnet
System.Runtime.WindowsRuntime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 26e1c53da8de7ba5466f2ab45f43bd21e1fd099ca5b92a2902b74f760f85c540
- MD5 0c3eb14c95afaa3801f4694418293294
- SHA1 a3ca1d3b9a713710d2e77515066e2c1054230489
- SHA512 954fa4882d5c8acd1663a9d293e5ed4ebf804f07e4f5c023d31436d5146bb2c05bc2024379e15894f4ac9f43d191a7c5b60f2c798ed83fdd9cd53bd64b97832b
- SSDEEP 3072:7DmAZ/cJp2RTYTS7CBFjQOkcnIbbudrpXpcPMlQDZm4Vqp7bW:7TUWkbBFjQOZISpXpc0lQNmle
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
136394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Runtime.WindowsRuntime.pdb
mscoree
_CorDllMain
Name
.text
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Windows.winmd
- SHA256 27e0620923d051c2c9645762092344d12cd353e9ef1850da71d379632d30f396
- MD5 dcf2905f4b6d9b6d5f9c80f1342e92aa
- SHA1 5fcdd77ea587428226fc0e92de939843f1d0d541
- SHA512 71ffe54aaaef9624edd16d55b82dec6590e6dce97e4b03a92df7535b2720c7b942a88b4d394b480ce9be892cc04e84d52959d8c980ccfb0e8323ec10cc3f3ae0
- SSDEEP 49152:0dhRy2XScCZsav07AJUtulyG2WuAQjNcxi2z8ZtOIgkstoZpnFNz6Wm:Whg2dy07AJrOXAQjNcxipzO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
6.6MB
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ