stardock.start11.archive.archive.by.aaocg.zip
- SHA256 bb08f51d33ccc5ded42d8d2b58540e64248ac6128fbfabb2af5ad876a8709ddb
Password
12345
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FILE_ID.diz
Resource
win11-20250217-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
aaocg.nfo
Resource
win11-20250218-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
stardock.start11.archive.archive.by.aaocg.exe
Resource
win11-20250217-en
windows11-21h2-x64
14 signatures
300 seconds
General
- Target stardock.start11.archive.archive.by.aaocg.zip
- Size 6.1MB
- Sample250303-x6bvbawpt9
- SHA256 bb08f51d33ccc5ded42d8d2b58540e64248ac6128fbfabb2af5ad876a8709ddb
- MD5 3cb68890b86370cff0456006cf4146be
- SHA1 9cb89d6d0ccf3887072de78d67ce92a7127346d8
- SHA512 500cb06f99d2c5d698475e86a2ca20904b134a176be2cf6ea06e424e5fb9b82dc72725ea4aee5da497e5968faccba47fac8c6a8a9a77fa093a245dd7d23183d2
- SSDEEP 98304:PwMXd1EJ/ObbFi7Rnbgjxh3GaMZbUpKpXbuka6hvZs7s3Wdh7ZV7fDEssD:omw/ObbFi7RnbMnGaMZbUcp13qH8sC
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/stardock.start11.archive.archive.by.aaocg.exe
File Explorer
-
stardock.start11.archive.archive.by.aaocg.zip.zip 6.1MB
-
stardock.start11.archive.archive.by.aaocg.zip.zip 6.1MB
-
FILE_ID.DIZ44B
-
Password.HERE.jpeg.jpg 2KB
-
aaocg.nfo4KB
-
stardock.start11.archive.archive.by.aaocg.exe.exe 6.2MB
stardock.start11.archive.archive.by.aaocg.zip
- SHA256 6572a88147a880678c51f85b6c4c20ea77d9a6f5e07541e58b710ae216c37adb
- MD5 a51de855cbeb8f6edd69523ac584cf7a
- SHA1 49733e232cff2be833bd4f0632a98c3dc7c3f0d3
- SHA512 28e6790ed366e21ed6c96a8f2676df3c2e0e6805cd6e3bf1bc6b074d2ddb021985461f8ea334559a3df7514fd911104775ba8435f8a3ab3be52e94d2267efae2
- SSDEEP 98304:2wMXd1EJ/ObbFi7Rnbgjxh3GaMZbUpKpXbuka6hvZs7s3Wdh7ZV7fDEssj:rmw/ObbFi7RnbMnGaMZbUcp13qH8s0
- MD5 SHA1 SHA512 SSDEEP
Password
12345
FILE_ID.DIZ
- SHA256 7b39bac796f7e0279cbc695144c75f7ebc2185f4f43b585b22e8a49d07a75e1c
- MD5 c0caaa915728e533c8e4cec0fc2cd97a
- SHA1 875fee9054da5f918efc92c35b9be4ffad5e731f
- SHA512 6909111055beabf13920651c77f9c8f12f68092ff01077d051e7ca74c2d079f458fd1e7a180c9fcae629963a429717bf7cef95f39c67d2b65c6ed16c86ceda21
- MD5 SHA1 SHA512
Password.HERE.jpeg
- SHA256 ea0cf8f20c6480951e761b1a0a550cd61f1082f93553aea244d5f45e23732680
- MD5 5d820ce69369e8b56fb5338e638a6adf
- SHA1 d959eb574fe0e74cc982fc8e2da66fe63f3fafe1
- SHA512 f79cc3c8ef10b4b7ea6a33ec3d4e6ac9328631ab51561005515362907039a59475d4b4b7e351b2920c1ca184490e08b11ffb09f3502e9d8acbb00b457721bcee
- MD5 SHA1 SHA512
Password
12345
aaocg.nfo
- SHA256 61de2638517894d43a581d94f92917e4e7fc8565ca29991dd5ec05ef40253ade
- MD5 604ac67883e403521010710c74794e50
- SHA1 a2088a00acaf8aa8e73a98a8b7dfbd9fd4127904
- SHA512 d02e4aae8ff2b21ba7458ee5291f68b95179c4d2917ac4189ef6a90aa40168f6537097e10b12b3299b69912a00362d5a7a1e3c6283f3d5d5362c3da82157921b
- SSDEEP 24:Y4CCak5LNmacMdwYPRMWAXTgpP9KW38QbJ/qvdrWbx1uSLgxO0ERt08W6:jrNm2wYpM3XTMkK8GkwbXXqO0EL0D6
- MD5 SHA1 SHA512 SSDEEP
stardock.start11.archive.archive.by.aaocg.exe
- IMPHASH bc758c921c6e0fda5a933c5b8a3c02e9
- SHA256 fbc21c408c6d2068fcb30026c0bf9451f776d534cbe91394b184ae2d1a364572
- MD5 45e5bd4932eb624568c4785934910de7
- SHA1 e3197fac1a09e8ee6ff23da368fe97a32b504807
- SHA512 f6d489bfcd919a4f4fb80cb0ed64d50444dc8f6e835d28258928ba34feaf9cb87386fe5d39f22aa463f9eeb0c4d6e5135dae27bfd8a189e91640e2212634b345
- SSDEEP 196608:ehJgab48Y3gcAWP8EScGkLWgcHr/akGVvJ:MgaMgcAS8EScGHgmTZSJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
12345
Minor OS version
2
Major OS version
5
Entry point
160128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetCurrentProcessId
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetTimeFormatW
GetDateFormatW
LocalFree
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapReAlloc
HeapAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
oleaut32
SysAllocString
SysFreeString
VariantClear
gdiplus
GdipCloneImage
GdipFree
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipAlloc
Name
.text
Size
232KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=241, version=40116,
count=141, id=243, version=40116,
count=13, id=242, version=40116,
count=2, id=253, version=31616,
count=18, id=260, version=31616,
count=9, id=259, version=31616,
count=55, id=261, version=31616,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=135, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=287, id=1, productName=Unmarked objects,
count=49, id=261, version=31630,
count=1, id=256, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,