additional_samples.zip
- SHA256 e0b5c6bd6c0769f881899e2cf345d66d8835dd6285cead1074d1eb89ed331a1f
Password
infected
Behavioral task
behavioral1
Sample
additional_samples/orange.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
additional_samples/orange.exe
Resource
win11-20250905-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target additional_samples.zip
- Size 67KB
- Sample251005-m7l2kattht
- SHA256 e0b5c6bd6c0769f881899e2cf345d66d8835dd6285cead1074d1eb89ed331a1f
- MD5 a07dbb216a203fc9552e3ec7c141c10b
- SHA1 97fcef87c4cbbb73625105db64ad873668dd01b4
- SHA512 99d8925d18a59098c0cebede555a66a6c680e2cd21c14e9a1d8a1c013f236999fad0a3cd50c319bc1b3faff2acdb0034fd8f390b1916898dc0f57a6efb634863
- SSDEEP 1536:j3nSnv5bdDcqW1fqXWkdeexptSPnVtYhSQNn/z6dVZ/JuPFpU+:jXovNO1fAf4ktSYhSQViZhn+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
brbbot
C2
-
brb.3dtuts.by
Signatures
- Brbbot family
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/additional_samples/apple.exe unpack001/additional_samples/orange.exe
File Explorer
-
additional_samples.zip.zip 67KB
-
additional_samples/apple.exe.exe 74KB
-
additional_samples/orange.exe.exe 42KB
additional_samples/apple.exe
- IMPHASH 475b069fec5e5868caeb7d4d89236c89
- SHA256 f47060d0f7de5ee651878eb18dd2d24b5003bdb03ef4f49879f448f05034a21e
- MD5 1c7243c8f3586b799a5f9a2e4200aa92
- SHA1 4db5a8e237937b6d7b435a8506b8584121a7e9e3
- SHA512 56cdf52cfcc102d2c8cc90e5a298eeaefd44002061108b0d6b330bb93c3590b3f8b2c3c4e1fa208fafeefa7dafa092bd0f57d3cf905382f88b9f66a5d84357fd
- SSDEEP 1536:b6sMD3H8V3jsUnHLiREsTbDV/48OO4vh47483gLi9+LSG:b6srVzJiRrTHVORe75g4+LS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
16276
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegFlushKey
RegCloseKey
CryptAcquireContextW
CryptDeriveKey
CryptReleaseContext
CryptEncrypt
CryptCreateHash
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
wininet
HttpSendRequestA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
InternetConnectA
InternetOpenA
HttpOpenRequestA
InternetSetOptionA
ws2_32
gethostbyname
WSACleanup
WSAStartup
inet_ntoa
gethostname
kernel32
CreateFileW
HeapSize
WriteConsoleW
SetStdHandle
LoadLibraryW
GetStringTypeW
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
CreateFileA
FindResourceA
LoadResource
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
SizeofResource
GetLastError
LockResource
GetModuleHandleA
CloseHandle
GetComputerNameA
HeapReAlloc
MoveFileExA
WaitForSingleObject
SetEvent
GetModuleHandleW
GetSystemWow64DirectoryA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
CopyFileA
CreateEventW
GetModuleFileNameA
DeleteFileA
GetFileSize
ReadFile
WideCharToMultiByte
GetProcAddress
GetTempFileNameA
GetTempPathA
FlushFileBuffers
GetConsoleMode
GetCommandLineW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
ExitProcess
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
MultiByteToWideChar
SetFilePointer
GetConsoleCP
user32
GetDC
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
774B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=171, productName=VS2010 build 30319, version=30319,
count=92, id=170, productName=VS2010 build 30319, version=30319,
count=11, id=158, productName=VS2010 build 30319, version=30319,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=127, id=1, productName=Unmarked objects,
count=5, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
additional_samples/orange.exe
- SHA256 5b7228947b256f36bd98dde1622799cda8f7a7aa0f3196aba08200fe8439dfee
- MD5 fb1569b5a3266444d676e5f82d6bac85
- SHA1 f0d76b3806e58ae5363a78dcc62b5e27a90a7ecf
- SHA512 2584d631df068f3efdb830747845ee2de3ee39f13a366289ef602d1f1e11782d9f9d9eef87f1e12c875f4ad842a2bf1d88934202f6c997db4a95229a6e0569d4
- SSDEEP 768:OIVlbMb8fL1YwirvVmcWXhi+I661D/wlzPDruLDTB:OsiADEtLWxSHh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44041
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=9, id=25, version=9210,
count=47, id=1, productName=Unmarked objects,
count=1, id=28, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,