sada.7z
- SHA256 14aa3643ba7ec062e8886814e6c74904eea5cf9c64c0df6e52d390dee6dbfec9
Behavioral task
behavioral1
Sample
sada.7z
Resource
win11-20250619-en
http://petya37h9lggpod1.onion/BakaWB
http://petya5km01aakfd7.onion/BakaWB
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/0.exe |
| unpack001/1.exe |
| unpack001/2.exe |
| unpack001/3.exe |
| unpack001/4.exe |
| unpack001/5.exe |
| unpack001/5C.exe |
| unpack001/6c.dll |
| unpack001/8c.dll |
| unpack001/AForge.Video.DirectShow.dll |
| unpack001/AForge.Video.dll |
| unpack001/AForge.dll |
| unpack004/CommonServiceLocator.dll |
| unpack004/Confuser.CLI.exe |
| unpack004/Confuser.Core.dll |
| unpack004/Confuser.DynCipher.dll |
| unpack004/Confuser.Protections.dll |
| unpack004/Confuser.Renamer.dll |
| unpack004/Confuser.Runtime.dll |
| unpack004/GalaSoft.MvvmLight.Extras.dll |
| unpack004/GalaSoft.MvvmLight.Platform.dll |
| unpack004/GalaSoft.MvvmLight.dll |
| unpack004/NDesk.Options.dll |
| unpack004/Ookii.Dialogs.Wpf.dll |
| unpack004/dnlib.dll |
| unpack001/CelestialDES.exe |
| unpack005/CommonServiceLocator.dll |
| unpack005/Confuser.CLI.exe |
| unpack005/Confuser.Core.dll |
| unpack005/Confuser.DynCipher.dll |
| unpack005/Confuser.Protections.dll |
| unpack005/Confuser.Renamer.dll |
| unpack005/Confuser.Runtime.dll |
| unpack005/GalaSoft.MvvmLight.Extras.dll |
| unpack005/GalaSoft.MvvmLight.Platform.dll |
| unpack005/GalaSoft.MvvmLight.dll |
| unpack005/NDesk.Options.dll |
| unpack005/Ookii.Dialogs.Wpf.dll |
| unpack005/dnlib.dll |
| unpack001/DotNetZip.dll |
| unpack001/IconExtractor.dll |
| unpack001/JunkAdder.exe |
| unpack001/Notifications.Wpf.dll |
| unpack001/Properties.Resources.Designer.cs.dll |
| unpack001/Runtime.dll |
| unpack001/SharpDX.DXGI.dll |
| unpack001/SharpDX.Direct3D11.dll |
| unpack001/SharpDX.Direct3D9.dll |
| unpack001/SharpDX.dll |
| unpack001/Vestris.ResourceLib.dll |
| unpack001/WinMM.Net.dll |
| unpack001/asm.exe |
| unpack001/celestialC.exe |
| unpack001/d.exe |
| unpack001/dnlib.dll |
| unpack001/m.exe |
| unpack001/testlib1.dll |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
qr http://x64dbg.com
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=261, version=31935,
count=8, id=260, version=31935,
count=3, id=259, version=31935,
count=6, id=257, version=31935,
count=3, id=257, version=28900,
count=54, id=1, productName=Unmarked objects,
count=1, id=265, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=261, version=31935,
count=10, id=260, version=31935,
count=1, id=259, version=31935,
count=4, id=257, version=31935,
count=3, id=257, version=28900,
count=50, id=1, productName=Unmarked objects,
count=1, id=265, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 28, 2017
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 28, 2017
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=244, version=40116,
count=10, id=259, version=25810,
count=21, id=260, version=25810,
count=7, id=239, version=40116,
count=192, id=1, productName=Unmarked objects,
count=98, id=261, version=25810,
count=31, id=265, version=25810,
count=1, id=256, version=25810,
count=1, id=255, version=25810,
count=1, id=258, version=25810,
Nov 28, 2017
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 28, 2017
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=244, version=40116,
count=1, id=199, version=41118,
count=19, id=259, version=25810,
count=18, id=260, version=25810,
count=7, id=239, version=40116,
count=187, id=1, productName=Unmarked objects,
count=99, id=261, version=25810,
count=31, id=265, version=25810,
count=1, id=256, version=25810,
count=1, id=255, version=25810,
count=1, id=258, version=25810,
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 5, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 5, 2016
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
May 15, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
May 15, 2018
Feb 18, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Feb 18, 2013
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 28, 2017
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 28, 2017
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=244, version=40116,
count=10, id=259, version=25810,
count=21, id=260, version=25810,
count=7, id=239, version=40116,
count=192, id=1, productName=Unmarked objects,
count=98, id=261, version=25810,
count=31, id=265, version=25810,
count=1, id=256, version=25810,
count=1, id=255, version=25810,
count=1, id=258, version=25810,
Nov 28, 2017
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 28, 2017
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=244, version=40116,
count=1, id=199, version=41118,
count=19, id=259, version=25810,
count=18, id=260, version=25810,
count=7, id=239, version=40116,
count=187, id=1, productName=Unmarked objects,
count=99, id=261, version=25810,
count=31, id=265, version=25810,
count=1, id=256, version=25810,
count=1, id=255, version=25810,
count=1, id=258, version=25810,
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 5, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 5, 2016
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 20, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
May 15, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
May 15, 2018
Feb 18, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Feb 18, 2013
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Feb 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 18, 2022
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 18, 2022
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Feb 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 19, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 19, 2017
Feb 26, 2022
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 27, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Feb 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.