15c5209905b69c0c3fc0321ff375ed07bc0a60ea1a4bcae8eefbb4c9c7153c00.zip
- SHA256 15c5209905b69c0c3fc0321ff375ed07bc0a60ea1a4bcae8eefbb4c9c7153c00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TradingView Installer .exe
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
TradingView Installer .exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target 15c5209905b69c0c3fc0321ff375ed07bc0a60ea1a4bcae8eefbb4c9c7153c00.zip
- Size 1.4MB
- Sample260423-dw319shy21
- SHA256 15c5209905b69c0c3fc0321ff375ed07bc0a60ea1a4bcae8eefbb4c9c7153c00
- MD5 839b7434fffabde0a1cfc7e2be028445
- SHA1 01f724ebd54fa6f066986190276a651bccf093f4
- SHA512 8a0d5e0d172946c31ba93385bb0f592186bc7b58dbeb9c0faedbd8bfacf731351a835ef4bab6705d7a07d94c6a710bb08fcb93a6d1ee19dd6e4dc6ef097a948f
- SSDEEP 24576:vA+F0rAKzDaHIdJq0c0TtF6o9RT8PAOAWttw:v1UAKfwSJqzSX6+MAOAd
- TLSH T11D65BC04F8F4629AD8B1D4288E2024C5D3E2ADD6EF64672662A5FFA12F773D09051CF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TradingView Installer .exe
File Explorer
-
15c5209905b69c0c3fc0321ff375ed07bc0a60ea1a4bcae8eefbb4c9c7153c00.zip.zip 1.4MB
-
TradingView Installer .exe.exe 101.6MB
TradingView Installer .exe
- IMPHASH 4fac38a977655de0f2858087be1ed60a
- SHA256 c210dbc29f8e68c0b1e1a3812a9b7bdb0af369436c03a07ae0eb10143b2f75a0
- MD5 72366ff21bb09f3d75109bc33c88fc52
- SHA1 baf142dbe527a55f8a530efbf82fdc657ef69e7e
- SHA512 42e73eb511c7d44e92dca1ec07b4aec147f60f1f186f8a14a1c9803d8f5ecd752ccf79259bb818c4fabcb908a91fe4f8e1ba3ae0abbf495f20dd804590639d22
- SSDEEP 24576:4kBWrpsh3SIA83dDJG+2DR7BWYpiwo44CUdmtBWmpW:vk23A807VJ18i9
- TLSH T10A386D8627AD34CDD114023FEB0A7AC7EAA3C36CED631412B64D701C5997BBBF5A5812
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9816
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\85023\Desktop\项目代码库\ExeBundler\bin\Release\Loader.pdb
kernel32
CreateDirectoryW
ReadFile
GetFileSizeEx
WriteFile
ExpandEnvironmentStringsW
GetModuleFileNameW
WaitForSingleObject
CreateFileW
CloseHandle
SetFilePointerEx
CreateProcessW
WriteConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
Name
.text
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=44, id=261, version=35207,
count=3, id=257, version=33145,
count=96, id=1, productName=Unmarked objects,
count=1, id=265, version=35225,
count=1, id=255, version=35225,
count=1, id=151,
count=1, id=258, version=35225,