Temp.zip
- SHA256 9b40c7785aeba3cba5a9d396ec2bbd41470ff09da15aff5f469f66b97920b777
Behavioral task
behavioral1
Sample
Temp.zip
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
300 seconds
General
- Target Temp.zip
- Size 3.4MB
- Sample260401-dkrtvsbt71
- SHA256 9b40c7785aeba3cba5a9d396ec2bbd41470ff09da15aff5f469f66b97920b777
- MD5 c7990310c7d62af303ffdb1c4c5a3f3d
- SHA1 92ed12e99a7bde21dd39c0dabaa40d82cbb7f731
- SHA512 31669e5f071f7d8202d810e415c88e28328f37504ca1b4ca6352c14dd1e4e74a5ae3aff881d1b6f560efc301f45b3fc1e3e41776935f2274ef7294a98231e1e3
- SSDEEP 98304:I6ZGMzfCLhv1AU3FBJQxBp0KCc/urueoBbnaa/UMZWT:zZGMzfKLFrW1t2Howa/Ny
- TLSH T1D5F533423D1390D22F15EC7A87035EB142637A8FC1D56FA65C8C03A39F68F8CA5A795E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Coffloader family
- Detects Coffloader 1 IoCs
resource yara_rule static1/unpack001/sql.log family_coffloader - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/sql.log
File Explorer
-
Temp.zip.zip 3.4MB
-
sfping.txt88B
-
sql.log.exe 8.5MB
sfping.txt
- SHA256 043f57d87849a856d1e563e599cbf234ca0b864bab238df200489b74ea3a1a20
- MD5 166f3a4f63e77a4979ffe01e3c024006
- SHA1 1940a88a03fcf29a6b81b1df838364cf7df9b21c
- SHA512 390a8d15bd9b5d64566b5865173426fcfa5fa3737f48bbee2612ce48f951d7b741c626ef9974933a2f5fbcfc2b6fc762e54d78d8cf1d0fb9ff0f70f94679665d
- TLSH T10BB012AC05A3003018BD489004E490598C103176B119361381041DF0B1110928009034
- MD5 SHA1 SHA512 TLSH
sql.log
- IMPHASH 23c05762169bf3896a03038c14bd0c65
- SHA256 88b7f2732181a122c95c7e9d9e53b2711e8b1271517c212f17df092863eaed24
- MD5 8e7ed22470391e958c4fad920689d12c
- SHA1 2f2d928a573f216cc00ce8712b34ddf73a34f429
- SHA512 7eadc289673b1094d9654cff72f72489fcc538fa92e97c095f9a51e1fc833c8778eea9be206fcf5bb9c0e2fcd0ad1c56d108bf99a306182e0e19d2d75c4e43f9
- SSDEEP 98304:V/31bGr6YpPQcq7EHFGn7kw2v2r3sEWwPvQ:Vfm22voV
- TLSH T1D4963943F85145A8C1EDD134CA768262BA703C895B3423D76B60F7B82F73BD4AA7A354
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Coffloader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
RevertToSelf
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateProcessA
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
QueryPerformanceCounter
ResumeThread
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetThreadPriority
SetThreadToken
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TerminateProcess
TlsAlloc
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthread
_cexit
_errno
_fmode
_initterm
_onexit
_vsnprintf
abort
calloc
exit
fclose
fopen
fprintf
fread
free
fseek
ftell
fwrite
malloc
mbstowcs_s
memcpy
memset
printf
putchar
puts
realloc
signal
strcat_s
strcmp
strlen
strncmp
strncpy
strtok
strtol
vfprintf
vprintf
wcslen
_cgo_dummy_export
Name
.text
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
577KB
Virtual Size
577KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
432KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ