malware_samples.zip
- SHA256 487f4dd9bdbe94a9cf1a04a8fdec19f16f86864d05d06f0511544b3ff68c850c
Password
infected
Resubmissions
16/04/2025, 23:23
250416-3dkjmsw1ds1016/04/2025, 23:22
250416-3crxbs1ms51016/04/2025, 23:16
250416-29atms1ly81016/04/2025, 23:10
250416-2523bswzgx1016/04/2025, 21:45
250416-1madxsvzg11016/04/2025, 21:28
250416-1be52azmt61016/04/2025, 21:16
250416-z4vkrazlz91016/04/2025, 21:06
250416-zx2eqavygy10Static task
static1
13 signatures
Behavioral task
behavioral1
Sample
virusshare/3/VirusShare_5c8b670c503455baafbff400a446cf82.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
virusshare/3/VirusShare_5c8b670c503455baafbff400a446cf82.exe
Resource
win11-20250410-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target malware_samples.zip
- Size 19.1MB
- Sample250416-1be52azmt6
- SHA256 487f4dd9bdbe94a9cf1a04a8fdec19f16f86864d05d06f0511544b3ff68c850c
- MD5 d8e816c76ab1b9bc76e73b1aa0f88f2d
- SHA1 da193bad12f1b79f8c938d62e8029ba948433859
- SHA512 5bd84b71cb39d1d4952255cbabc45608c972757bb63a9f70606e0d2200154374f9e61f1c526ed1fe903b166e5d0b0458540b47da9c70434ae5b31a7b7d1bd02a
- SSDEEP 393216:ThCblxXJLB2mW/RxHedw0OZnq0NyWl9Hh9H2KAm4zI:ThSDZLI5xHea9Zf5XHD4zI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cobaltstrike
Botnet
-
0
C2
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
Attributes
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Extracted
Family
-
trickbot
Version
-
1000501
Botnet
-
ono33
C2
-
5.182.210.226:443
-
5.182.210.120:443
-
185.65.202.183:443
-
212.80.217.243:443
-
85.143.218.249:443
-
194.5.250.178:443
-
198.15.119.121:443
-
107.175.87.142:443
-
185.14.31.72:443
-
188.165.62.2:443
-
194.5.250.179:443
-
198.15.119.71:443
-
185.14.29.4:443
-
185.99.2.202:443
-
192.3.193.162:443
-
89.191.234.89:443
-
195.54.32.12:443
-
31.131.21.30:443
-
5.34.177.194:443
-
190.214.13.2:449
-
181.140.173.186:449
-
181.129.104.139:449
-
181.113.28.146:449
-
181.112.157.42:449
-
170.84.78.224:449
-
200.21.51.38:449
-
46.174.235.36:449
-
36.89.85.103:449
-
181.129.134.18:449
-
186.71.150.23:449
-
131.161.253.190:449
-
200.127.121.99:449
-
114.8.133.71:449
-
119.252.165.75:449
-
121.100.19.18:449
-
202.29.215.114:449
-
180.180.216.177:449
-
171.100.142.238:449
-
186.232.91.240:449
-
181.196.207.202:449
Attributes
-
autorunName:pwgrab
ecc_pubkey.base64
Signatures
- Cobalt Strike reflective loader 2 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule static1/unpack001/virusshare/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287 cobalt_reflective_dll static1/unpack001/virusshare/1/malware cobalt_reflective_dll - Cobaltstrike family
- Trickbot family
- XMRig Miner payload 2 IoCs
resource yara_rule static1/unpack001/virusshare/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287 xmrig static1/unpack001/virusshare/1/malware xmrig - Xmrig family
- Office macro that triggers on suspicious action 4 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack001/virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9 office_macro_on_action static1/unpack001/virusshare/2/VirusShare_3f0b1eed4b7b9ae05fab4d949843f103 office_macro_on_action static1/unpack001/virusshare/3/VirusShare_3fb34964fa7b8c6bfad8d960380ff04e office_macro_on_action static1/unpack001/virusshare/4/VirusShare_4b8eb7fe75f72c1c5c1f80af9cd165d2 office_macro_on_action -
resource static1/unpack001/virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9 - Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis
- Declares services with permission to bind to the system 1 IoCs
description ioc Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE - Requests dangerous framework permissions 3 IoCs
description ioc Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to send SMS messages. android.permission.SEND_SMS -
resource yara_rule static1/unpack001/virusshare/1/VirusShare_0aee78510c46e3a200b6bc21ac1c954d upx - Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/virusshare/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287 unpack003/out.upx unpack001/virusshare/1/malware unpack001/virusshare/2/VirusShare_01b55404de50bd1a56343b2f316ff88d unpack001/virusshare/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b unpack001/virusshare/3/VirusShare_5c8b670c503455baafbff400a446cf82 unpack001/virusshare/4/VirusShare_6d2d7d94fe5faab76b3e786e7d810c1d
File Explorer
-
malware_samples.zip.zip 19.1MB
-
virusshare/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287.exe 5.7MB
-
virusshare/1/VirusShare_0aee78510c46e3a200b6bc21ac1c954d.exe 633KB
-
out.upx.exe 1.6MB
-
virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls 937KB
-
virusshare/1/VirusShare_1ba8249d8503c0cf7bc125588c43bef9.doc 182KB
-
virusshare/1/VirusShare_3cd9a967b67fe69351e390195ca7a430.pdf 32KB
-
virusshare/1/malware.exe 5.7MB
-
virusshare/2/VirusShare_01b55404de50bd1a56343b2f316ff88d.exe 121KB
-
virusshare/2/VirusShare_1ad9a67240d5775395c45b64dd6529fa.exe 2.9MB
-
virusshare/2/VirusShare_2fe5b00079aec2d8369a798230313ec8.doc 125KB
-
virusshare/2/VirusShare_3f0b1eed4b7b9ae05fab4d949843f103.doc .vbs 35KB
-
virusshare/2/VirusShare_480ef02bb062a57724e1b3e14532a140.pdf 32KB
-
virusshare/2/wedding.apk.apk 5.3MB
-
virusshare/3/VirusShare_3fb34964fa7b8c6bfad8d960380ff04e.doc .vbs 34KB
-
virusshare/3/VirusShare_4675e87be15585e66b0c88b833dd9ecd.pdf 32KB
-
virusshare/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe 64KB
-
virusshare/3/VirusShare_5c8b670c503455baafbff400a446cf82.exe 208KB
-
virusshare/3/VirusShare_6ad036ba93c94d6976e2d93c7a3aec6f.doc 172KB
-
virusshare/3/delivery.apk.apk 5.3MB
-
virusshare/4/VirusShare_4b8eb7fe75f72c1c5c1f80af9cd165d2.doc 64KB
-
virusshare/4/VirusShare_6d2d7d94fe5faab76b3e786e7d810c1d.exe 2.3MB
virusshare/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287
- SHA256 e800fce6aadc7792b912abbb693aafe0905a5ab52bc92de9e2a50089de312be9
- MD5 0a2d1ecedf3f79754aa2c18d62e75287
- SHA1 4dc6c7ad46c152ee6ebf26488fd5136dd9acfa4f
- SHA512 00be04178ca0451634ce16e6b5348b768e0bc017dc8b5c6fd9fef1a7110a305b0fa6f240ca486e76f8b13c5e6aae6a416229c63750fb5a98230fd740423fee4f
- SSDEEP 98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUW:w+156utgpPF8u/7W
- MD5 SHA1 SHA512 SSDEEP
-
Cobalt Strike reflective loader
Detects the reflective loader used by Cobalt Strike.
-
XMRig Miner payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
631608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
619KB
Virtual Size
619KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=199, version=41118,
count=10, id=260, version=26504,
count=3, id=259, version=26504,
count=32, id=261, version=26504,
count=4, id=257, version=26504,
count=15, id=257, version=26715,
count=413, id=1, productName=Unmarked objects,
count=30, id=264, version=27905,
count=2, id=259, productName=VS2019 v16.2.3 build 27905, version=27905,
count=20, id=260, productName=VS2019 v16.2.3 build 27905, version=27905,
count=62, id=261, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=255, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.2.3 build 27905, version=27905,
virusshare/1/VirusShare_0aee78510c46e3a200b6bc21ac1c954d
- SHA256 c7d63abc749b1f4e245bd377c11ca5857735491eddab5c176ae99a3b7bf9e0ca
- MD5 0aee78510c46e3a200b6bc21ac1c954d
- SHA1 aa82dabf571edf16022381f9795376370d4ded7c
- SHA512 ff963b0d7f3b90c5d261c101d44c6b8d595cd809ae9e8378fc85d0442d2322a6cc3899a9ec4d2d6e662de32879120a5ba07bb883a20cd2003618aa69f2806117
- SSDEEP 12288:Px/w9Fmh+HWMxs+KuwetXwuV9W0P5qUKbxqkSnY:PNAckHWCsZulAeRP5VKtqk4Y
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Digest
8c:c8:f0:70:80:b1:2b:f4:14:36:02:ff:c8:11:86:e8:9e:6e:a6:68:d2:b6:8b:d0:e0:e4:4b:9e:c3:1e:8f:09
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,OU=RD Department,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN
Chains
Mar 27, 2018
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,OU=RD Department,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
a2:71:64:f3:87:e9:1d:ac:6e:ca:7d:87:06:ba:6e:06:ff:b4:8d:8f
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,OU=RD Department,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN
Chains
Mar 27, 2018
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,OU=RD Department,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN
Serial Number
60:86:44:63:bb:bc:2e:4e:67:d4:27:71:e4:cb:d9:a5
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 21, 2017 - Feb 4, 2020
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,OU=RD Department,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=Zhuhai,ST=Guangdong,C=CN
Serial Number
44:e0:b5:be:99:0e:46:a6:96:3f:d9:a1:0d:d4:bb:ac
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 19, 2017 - Feb 3, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=WoSign Time Stamping Signer G2,O=WoSign CA Limited,C=CN
Serial Number
6a:0f:db:e6:78:b3:1e:23:2c:ba:5a:e1:4d:9d:bf:1b
Issuer
CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 8, 2015 - Apr 8, 2023
Minor OS version
1
Major OS version
5
Entry point
1740768
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
509KB
Virtual Size
512KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
111KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=171, productName=VS2010 build 30319, version=30319,
count=11, id=152, version=20115,
count=30, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=287, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=514, id=1, productName=Unmarked objects,
count=167, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 31c20bf4e83cd57a130e928bc1dfc14212a05dca49227ddaa658dba62111567f
- MD5 7e81d94ad58220bae3a0a8bf072c8554
- SHA1 1a8e87e799db91d11e04a28fbbf898f5cd4c89b5
- SHA512 97030155ef136f8bce968f601fc13640065ccbba444921e8418bd718878d6e5327e1e76f03c1ed5e2493f4be96b6b2e9e19a0531fc93085bbaae1f084cc0a119
- SSDEEP 24576:ZvVP4k6zUpLQw/Vx6baZ7VqPxbt2SREi6aW3Wz06paL9hA4xMjc11:ZvVPbxRx/VUbaRQPNtHRKGhGZxMjc11
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
459998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
809KB
Virtual Size
809KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
256KB
Virtual Size
255KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
489KB
Virtual Size
488KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=171, productName=VS2010 build 30319, version=30319,
count=11, id=152, version=20115,
count=30, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=287, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=514, id=1, productName=Unmarked objects,
count=167, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9
- SHA256 64af94592f6707505fa6f42b58776c3635706a414e6362a92f707df84627679c
- MD5 0fea640a7da27f365b3675f73626b9c9
- SHA1 fd4825f244e9c145486cb6930ad05695b9972668
- SHA512 c9a10288762f3f5a3fdff17f8dd8560e7a884f1b83f405c2e85c6c86e42f69a30841c13aa0f2ecfc55aed42995d7aeb8fe40415e423ed0a306d2e7d00883dfbf
- SSDEEP 24576:h3zS0aqbCrxgFhFSQVB5DjDLG6/8otVBTN9s:K9Fo5VLDLGwTBT
- MD5 SHA1 SHA512 SSDEEP
-
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
Sem
Page1
Module1
UserForm1
Module2
Class1
UserForm6
Page11
Module6
Module5
Module4
virusshare/1/VirusShare_1ba8249d8503c0cf7bc125588c43bef9
- SHA256 a44031feb2a71980a0980377c8f7b6f3b5b9dfa0f708556dd420be323c7e1a38
- MD5 1ba8249d8503c0cf7bc125588c43bef9
- SHA1 eb473c845c7474010ff35a3e8a169a9b6b9e5ebe
- SHA512 b5421ca474e8ccd30683b90a83e98c6ba74c8418201aaa923ba6c7805ef724b37dfabb74cfedccbb69e3fcf923635f64faa406f280057404f78957df3d840c8c
- SSDEEP 3072:9NO2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBU9asiv8Oc7V:9NO2k4PF7tGiL3HJk9rD7b9asiv8dZ
- MD5 SHA1 SHA512 SSDEEP
Aojplemq
Jeuwzqvsdrcqz
Rgzhzedt
virusshare/1/VirusShare_3cd9a967b67fe69351e390195ca7a430
- SHA256 e96e3b90d9483a2e463fdda0edf27310ed10fbdb8a8b920c6480ca93bb2e1077
- MD5 3cd9a967b67fe69351e390195ca7a430
- SHA1 4e7f309d283182d76377ad02616a6a5933cac649
- SHA512 ffe9ffe8555ef0b914bdcaea5b50eb501c4b0d03726ab6f2baa0e5cf6875d9b0ac735679dbd03810d3f03905402f382bf32e3227bd2a11c0eef173082cb02273
- SSDEEP 768:XDNivfrO+Av3qpOCy71ShZ2/p1oaVBV2iKL2GmqBmmSE5fXuMZmwgCLWar8v:XB6zrAv3qpOCy71ShZ2R1osBV2iKL25p
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Extracted URLs
-
file http://amcarizona.com/uploads/1/3/0/4/130478709/d508b2931dd488.pdf
-
file http://aufgutdeutsch.net/uploads/1/3/0/2/130291646/zefawove_dojavakumavuv_fesadetekud_pixopibetegoso.pdf
-
file http://capscoating.com/uploads/1/3/0/5/130540699/waxasavapiz_tibuxe.pdf
-
file http://formormedia.com/uploads/1/3/0/2/130289443/130289443.html#auma+electric+actuator+catalogue
-
file http://fountainalleybodycare.com/uploads/1/3/0/2/130270832/kexerewel.pdf
-
file http://mingateachers.com/uploads/1/3/0/6/130620948/3396168.pdf
-
file http://mwilkinson91.com/uploads/1/3/0/5/130550994/d4e8bf21c6b2322.pdf
-
file http://nkaskephotography.com/uploads/1/3/0/3/130323319/941a1631a4c.pdf
-
file http://nrttourscentre.com/uploads/1/3/0/7/130776684/3637788.pdf
-
file http://pitchtreemetalworks.com/uploads/1/3/0/6/130620946/witenexupamafofakis.pdf
-
file http://soulsinfriendship.org/uploads/1/3/0/6/130621483/pebuliduv.pdf
-
file https://jofavape.weebly.com/uploads/1/3/0/4/130476440/xafoniwokivezezo.pdf
- Show all
virusshare/1/malware
- SHA256 e800fce6aadc7792b912abbb693aafe0905a5ab52bc92de9e2a50089de312be9
- MD5 0a2d1ecedf3f79754aa2c18d62e75287
- SHA1 4dc6c7ad46c152ee6ebf26488fd5136dd9acfa4f
- SHA512 00be04178ca0451634ce16e6b5348b768e0bc017dc8b5c6fd9fef1a7110a305b0fa6f240ca486e76f8b13c5e6aae6a416229c63750fb5a98230fd740423fee4f
- SSDEEP 98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUW:w+156utgpPF8u/7W
- MD5 SHA1 SHA512 SSDEEP
-
Cobalt Strike reflective loader
Detects the reflective loader used by Cobalt Strike.
-
XMRig Miner payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
631608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
619KB
Virtual Size
619KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
_TEXT_CN
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=199, version=41118,
count=10, id=260, version=26504,
count=3, id=259, version=26504,
count=32, id=261, version=26504,
count=4, id=257, version=26504,
count=15, id=257, version=26715,
count=413, id=1, productName=Unmarked objects,
count=30, id=264, version=27905,
count=2, id=259, productName=VS2019 v16.2.3 build 27905, version=27905,
count=20, id=260, productName=VS2019 v16.2.3 build 27905, version=27905,
count=62, id=261, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=255, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.2.3 build 27905, version=27905,
virusshare/2/VirusShare_01b55404de50bd1a56343b2f316ff88d
- SHA256 69bd652ace6469311a49a12f66bbbc691bdfc69aba958dd02d928464cbb46609
- MD5 01b55404de50bd1a56343b2f316ff88d
- SHA1 8a6b9599d3e71c83eaef7f5a23df21b4f41370b1
- SHA512 f1ec4bf6768dea2edc53c72dd7c884641a464f4268d21480bb55fbdb1079b8c5c9fb50eab4b29d13acb4a8682ca6ae291341e01b748e228b185676e48df2e598
- SSDEEP 3072:JrhJGtDfYtWAh3A8lKl+/63VBwxkbwQXz8lFTnc:JrhJoDfY13KE/qVlNYvnc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
11376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
virusshare/2/VirusShare_1ad9a67240d5775395c45b64dd6529fa
- IMPHASH 483f0c4259a9148c34961abbda6146c1
- SHA256 3751298058a2a5d0912caa35bfdbafa48ae788647b536e69ad383c7c1990dd9d
- MD5 1ad9a67240d5775395c45b64dd6529fa
- SHA1 c653d2c475f639ad68c210e0f9d829344c5663c7
- SHA512 721b1c577db1cfe5465eaceadf2a7cc9d3f68d341f98d7dcc4bde2ff606f359b6bc917e993f5f05e9897b7957ca2617fa03937c2aea6a8462b86f2e750397c23
- SSDEEP 49152:4obi85jFGg0IZHVA/pfa8u0Ikjhd6kss8CYxB52ibDIJZKpYg0Kg9e+KgFTRFO:Vzh6/I8u0IktgkOvxBUibs2Z0ggFdE
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
ab:40:24:7a:c9:3b:7b:19:d6:51:17:2f:8e:a5:56:5d:21:0d:23:88
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Rabbit Speedy (Superior Media Ltd.),O=Rabbit Speedy (Superior Media Ltd.),L=Tel Aviv,ST=Israel,C=IL
Chains
Apr 15, 2025
Subject
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Serial Number
e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Sep 11, 2018 - Sep 11, 2023
Subject
CN=Rabbit Speedy (Superior Media Ltd.),O=Rabbit Speedy (Superior Media Ltd.),L=Tel Aviv,ST=Israel,C=IL
Serial Number
45:f8:da:05:30:f5:16:06
Issuer
CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 29, 2019 - Jan 29, 2020
Subject
CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
64:33:51:d3:c7:38:9f:08
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 24, 2016 - Jun 24, 2031
Minor OS version
0
Major OS version
5
Entry point
91256
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
user32
GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
TranslateMessage
SetWindowLongW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
GetSystemMetrics
ExitWindowsEx
DispatchMessageW
DestroyWindow
CharUpperBuffW
CallWindowProcW
kernel32
GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
SizeofResource
SignalObjectAndWait
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResetEvent
RemoveDirectoryW
ReadFile
MultiByteToWideChar
LockResource
LoadResource
LoadLibraryW
LeaveCriticalSection
InitializeCriticalSection
GetWindowsDirectoryW
GetVersionExW
GetUserDefaultLangID
GetThreadLocale
GetSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeProcess
GetEnvironmentVariableW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentProcess
GetCommandLineW
GetCPInfo
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
EnumCalendarInfoW
EnterCriticalSection
DeleteFileW
DeleteCriticalSection
CreateProcessW
CreateFileW
CreateEventW
CreateDirectoryW
CompareStringW
CloseHandle
Sleep
comctl32
InitCommonControls
Name
.text
Size
81KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
21KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
virusshare/2/VirusShare_2fe5b00079aec2d8369a798230313ec8
- SHA256 8eb6805a0852b220695175ce81a5b139f1438dc06ea3fc1347b047702880374c
- MD5 2fe5b00079aec2d8369a798230313ec8
- SHA1 e233595a2ee62f6197fcc7d9088fce3505c38ec0
- SHA512 d9b4173274b49d7f041aea1a6866d5cc79530360668299385a10f25597b608308a5cb6502363709a7e09e43d30a1df95e1ab72fcc71852c78b51da016c2bbed7
- SSDEEP 3072:beKgdzSrG8KyIwLx3phgC1s0rPOWfKNR/:beKUzSLnLx3X3O0r2WfKNJ
- MD5 SHA1 SHA512 SSDEEP
Xmtcmcovmi
Rlndryuf
Sfxuqprex
virusshare/2/VirusShare_3f0b1eed4b7b9ae05fab4d949843f103
- SHA256 ce21d34bafe338effb8f619936f057084cb45743fce884a1465966d8523a00a8
- MD5 3f0b1eed4b7b9ae05fab4d949843f103
- SHA1 e5b9fa0a23f337adae93ed4e8fcd1e9d9db4acba
- SHA512 292183a9d0b3e5759453a43bcf34b8b1d09d09523687bfab090dd740a5c70169938904949b1c5a025b40082898dc3ec240ad2ec788b66f256efe5a041f774740
- SSDEEP 384:3+WbqwPv/ETzbVwNY/+TU5lHizK+BS3DzxW8M2GzraAzVCIXh3aM:OWbqm/EvZwO2TUrEQDtI2G31lX5
- MD5 SHA1 SHA512 SSDEEP
-
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
ThisWorkbook
Sheet1
Sheet2
Sheet3
Sheet4
Module1
virusshare/2/VirusShare_480ef02bb062a57724e1b3e14532a140
- SHA256 b2e302356d613a814a41d356a61cee24fc133dd032e4b02d8e29436aedd8d742
- MD5 480ef02bb062a57724e1b3e14532a140
- SHA1 5ea2c3fdeb0b399e1805a94d8e6af4ce0de2c63e
- SHA512 82587a541bdc570b15402ef33beb14d9681160dc6e520f0c34b3c040658d17a9ced58feaa350f3a6c56eb7236ceb4bd09ba6ece56d13113780a6fe1a5044a99f
- SSDEEP 768:9EKOUP0/RXtY+E1dhX2e1kaVsVri7sF9/I70u5M/E5vXuMZmwgCLWarCC:ROc0JTE1dhX2e1kssVri7sng0u5MyXFh
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Extracted URLs
-
file http://americanbenefitsolutions.net/uploads/1/3/0/5/130590122/0edbbc0c.pdf
-
file http://armquiz.com/uploads/2020/01/27/tusuzaw.pdf
-
file http://befreeproduction.com/uploads/1/3/0/4/130478663/3e464e773d.pdf
-
file http://bulverdepregnancy.net/uploads/1/3/0/6/130639282/wetivuxolaja.pdf
-
file http://clearhrsolutionsd.com/uploads/1/3/0/4/130435941/8c7e87.pdf
-
file http://link2yoo.net/uploads/1/3/0/6/130604529/42536e7ead401.pdf
-
file http://movimentomarianobetania.org/uploads/1/3/0/6/130603773/bupiwudunudasogof.pdf
-
file http://vertudevelopment.com/uploads/1/3/0/6/130605267/130605267.html#brother+intellifax+2820+driver
virusshare/2/wedding.apk
- SHA256 7a42d7809fdef76fe0580d09ef6780a96c000d97712236e6550d7fff061e122a
- MD5 7a78191dad2e8baf6b372a4dc864430c
- SHA1 92f7a09036d7fc1c4ada288fdb114e5e5dcb09c1
- SHA512 28ed1d04180dbf9fa7ea9561ddc112377c7d81f6ee1078ceb2fb93782cb29ff875bafc03f5906379f87060132d048ff1802748a97eb7cde9647893e5550c2c8d
- SSDEEP 98304:dTUWQ8/rUKDzU87SWbFnVNyYdOYmwKOQarbcDSaBd2ZrYub+4XD:dTLHPSw7Nd8v0rr3aX4XD
- MD5 SHA1 SHA512 SSDEEP
Password
infected
com.google.aplikasi
com.example.myapplicatior.MainActivity
android.permission.RECEIVE_SMS
android.permission.INTERNET
android.permission.READ_SMS
android.permission.SEND_SMS
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
com.example.myapplicatior.MainActivity
android.intent.action.MAIN
com.example.myapplicatior.NotificationService
android.service.notification.NotificationListenerService
androidx.work.impl.background.systemalarm.SystemAlarmService
androidx.work.impl.background.systemjob.SystemJobService
androidx.work.impl.foreground.SystemForegroundService
androidx.room.MultiInstanceInvalidationService
com.example.myapplicatior.ReceiveSms
android.provider.Telephony.SMS_RECEIVED
com.example.myapplicatior.SendSMS
android.provider.Telephony.SMS_RECEIVED
androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
android.net.conn.CONNECTIVITY_CHANGE
androidx.work.impl.background.systemalarm.RescheduleReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.background.systemalarm.UpdateProxies
androidx.work.impl.diagnostics.DiagnosticsReceiver
androidx.work.diagnostics.REQUEST_DIAGNOSTICS
androidx.startup.InitializationProvider
virusshare/3/VirusShare_3fb34964fa7b8c6bfad8d960380ff04e
- SHA256 26026b1b3d0cb660c6be6c536df679acca0b5562a3adbb507d001474d23f5650
- MD5 3fb34964fa7b8c6bfad8d960380ff04e
- SHA1 9a3aec40056ce74bac833989ed71dfb6c2626f4c
- SHA512 a82b522dfd7eac30292a9e9ab19ddac94563804e77a1090e5f44de7e794ef4e5ebe0e7fb36e5177479417c8176ae0475613700755ca015c7ce941a4740215faa
- SSDEEP 384:bzIPMepSbSsG/CdPvunCpeJzKoSS3D6JO5LfBqtjbjk4Eohubn3ezta:nIPMecWsGKVunFFRDE6pqjhust
- MD5 SHA1 SHA512 SSDEEP
-
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
ThisWorkbook
Sheet1
Sheet2
Sheet3
Sheet4
Module1
virusshare/3/VirusShare_4675e87be15585e66b0c88b833dd9ecd
- SHA256 77e2bcef8ff0e68646b27591faea3e15b4a09154d0611a5004ec028df5f36256
- MD5 4675e87be15585e66b0c88b833dd9ecd
- SHA1 b2c62b3cdc97ca86df9f06ea78bc4c59439d7a9b
- SHA512 433f88857e55d57f01230dabb3ca5c618311c45e93c82786ab2677a7d2522e91343bcb7f8df02c83abcc9d431e0bd553022b05ab1f7c2c7f05d621f07a7e19a1
- SSDEEP 768:YJ7cDLXeFL/i6XV7JCzYLggXw2E0Ua20dZU57DsM1uBsYJyWOOX8ohjaSD2stCQB:0c/XcLF8E5Z
- MD5 SHA1 SHA512 SSDEEP
virusshare/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b
- IMPHASH a32f20584ee1cae950a64ef226eea819
- SHA256 2e18ad3e470b97415beb2cdb8e3ef7510bad21f0a5add020a7f9343dd959eeaa
- MD5 4aa5734fe9c86184f931f4ddaf2d4d7b
- SHA1 a066ccad76f3c63d053cd68ac8692d4f4acf82ac
- SHA512 7355ffd3fc59af49af1d57f5327c7442a12c8e5ddc6ec9e176cc27fd4986cd6182f5f6ce91f892c07029efcac37f90d4dd077b6bb226b54c40621b94987a044c
- SSDEEP 384:rdP9JIA7uJ1wK2xBpHbVbl+NGYD90pSCfZziEKffhaekBfdReVwoGHdRsArr2rOR:R9JIqNl/SSrrpBfiIdRsorZucnjtsq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4332
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
MethCallEngine
ord666
ord595
ord596
ord525
EVENT_SINK_AddRef
ord568
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord710
ProcCallEngine
ord646
ord571
ord575
ord100
ord689
ord541
ord544
ord545
ord546
ord547
ord580
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=13, version=9782,
virusshare/3/VirusShare_5c8b670c503455baafbff400a446cf82
- SHA256 22564368a2143231eb51f0ecb501d9777060fd9dd832dcc88a799520884da40c
- MD5 5c8b670c503455baafbff400a446cf82
- SHA1 a3eebbc14b852f77318d9bd09117b1ef56f35ede
- SHA512 6f9bf4e52523c32d980ab29c63e21d29aafd358c7c2cabcca6455685e1a683f96a718efe230d76687b72ce60b24c36c541e720a2d86d490835d481cf93c12d64
- SSDEEP 6144:jG3XIHrH91T+dG8tlj+ur37VW7SrBLl2mr/ruei+QE4lIVnAEsnnnnnn:jG3XorH3YGeljtr37s7SrBLrTaei+Qtz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
9847
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
188KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
virusshare/3/VirusShare_6ad036ba93c94d6976e2d93c7a3aec6f
- SHA256 4ee0bf78e3b0a06c35fed0f912db6fabbb5fae13f838cd4132634359ad0d24da
- MD5 6ad036ba93c94d6976e2d93c7a3aec6f
- SHA1 cb098f7a0492454a31f3819a1b7ec143c0c507b6
- SHA512 525d3ccb7078d6c34287307891023a47773cb3ec94d6e5d54a4c2cb4006be5ae3356238e8fe4ce5ff17767b8326af385a2be735dac8dbe78f10c185c665f7a00
- SSDEEP 3072:vw2y/GdyrktGDWLS0HZWD5w8K7Nk9pD7IBUaT7jc5Hw:vw2k4jtGiL3HJk9pD7b+jMQ
- MD5 SHA1 SHA512 SSDEEP
Hsheolxjq
Ytxatmhtmzwws
Gwgukvssw
virusshare/3/delivery.apk
- SHA256 1cb93604fc99d47c24e7c6db6c6286ad40a4c2edf079612b5b1d3b9b91b65c1e
- MD5 87692d3c410fcc2d6c77258bef05690b
- SHA1 3944cfa9f19b7ea61294cc7369eacb0ccbaea2a5
- SHA512 cad42db57dadd1a6102d57069514e0b36487d7a91f64ab6b91d634ce0231adb4e799eca5012e401c00068758d3ba0e8c593bdfea63ac29d81192a2c90a119e15
- SSDEEP 98304:p2EzHTfuoWrFgaqEwn60D+lJ2DiHe9u5sm2sFxD2N4HKWeK:p2EzHxo6xEw9+jzEG+sheK
- MD5 SHA1 SHA512 SSDEEP
com.rndytech.smstesd
com.example.myapplication.MainActivity
android.permission.RECEIVE_SMS
android.permission.INTERNET
android.permission.READ_SMS
android.permission.SEND_SMS
com.example.myapplication.MainActivity
android.intent.action.MAIN
com.example.myapplication.ReceiveSms
android.provider.Telephony.SMS_RECEIVED
com.example.myapplication.SendSMS
android.provider.Telephony.SMS_RECEIVED
androidx.startup.InitializationProvider
virusshare/4/VirusShare_4b8eb7fe75f72c1c5c1f80af9cd165d2
- SHA256 55dd85b37566755ea1ffb022030b413d2722120067abd9b298a89a61f4b790c2
- MD5 4b8eb7fe75f72c1c5c1f80af9cd165d2
- SHA1 b227eb90323259f6ff11e0436ba03ebd97706e99
- SHA512 6a64a0c2d1c9f825aca460c692b96cf40ab511d81ee3d56f52870fe5648d902d6a3ac6c70cc85c4d86bd6b51a1d72373c75635731b2f354f8b541a7727f4e8fd
- SSDEEP 1536:LYg6BQIewyy7WxIAGWdw3/WEjMTrP4yyh+A4u7sUjl:t6BQhwAxIbp3XOS
- MD5 SHA1 SHA512 SSDEEP
-
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
ThisWorkbook
Sheet1
Module1
AttachedFile
AttachedFiles
Module2
Sheet2
virusshare/4/VirusShare_6d2d7d94fe5faab76b3e786e7d810c1d
- SHA256 3085c886924395409bd3e1cd673e463001f9ff9aedf829de843b462f8138cb0a
- MD5 b66689ebd2ec53c0035ac39262343ab4
- SHA1 540c5e9b8b28feeba3a05cb1d579154e442f8dfb
- SHA512 6e686a6badff204b3aa1e3f5d03a188f8cb9139f553ab33f4632b9d9af1897048e34fd84daa5223c4308ae8837810bbecf9da9e9ae6a2ccb6dbdc60cde72ef44
- SSDEEP 49152:SXdKAVoO2sFEgNEeazOl88uzkzx59ZmLPMfLUnpyLyfZozvhlJRqk8TW44M41JLp:SXVXO0E5zOC8uzkL9+4ElIPl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
2068110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
736KB
Virtual Size
735KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
39KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.giats
Size
512B
Virtual Size
28B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
229KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ