MoneyGram_Trxn_receipt_jpg.zip
- SHA256 eded976f249eabc7ce5590f36b7656f34f29c8fcc9f1c5560bc4d608b59d4564
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MoneyGram_Trxn_receipt_jpg.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
MpClient.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
MpClient.dll
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target MoneyGram_Trxn_receipt_jpg.zip
- Size 2.5MB
- Sample260504-w448eaav6y
- SHA256 eded976f249eabc7ce5590f36b7656f34f29c8fcc9f1c5560bc4d608b59d4564
- MD5 056519cb3de49825e8f2c9b40da8cfa7
- SHA1 85ba6b09f571651fa5bd902a8039fa56ec545ec3
- SHA512 83d7770dc6b646a3f83f6ad1c4b73ea8c379cf0c1e40101c4933ed74551ce1b2e8eff12c46e806986461ea30b6ce939631d1f785f4304232380c6b790d1ea6c6
- SSDEEP 49152:m+prgsw+NsdiL9quCdOVFFqzTE1eLWrGcTRNQoKiSLI:mcsX+WS9qusOVbqzTuacPQjf8
- TLSH T192C533202E87F20D2DAF93ADF943A11F45E892736C9AF5994FB383C295165B873640F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MpClient.dll
File Explorer
-
MoneyGram_Trxn_receipt_jpg.zip.zip 2.5MB
-
MoneyGram_Trxn_receipt_jpg.exe.exe 669KB
-
MpClient.dll.dll 2.6MB
MoneyGram_Trxn_receipt_jpg.exe
- IMPHASH 1c0630c6f45b09b84ce7610613abd2ce
- SHA256 74ac0ce73b60da8fec05c19202eed693363e6c6bc01cdf700d668c2eac591b92
- MD5 8bed539a458c502028f0df905c580117
- SHA1 90aa5c4f57eca762027a0870f7d7e60b5726de24
- SHA512 3efef387743d38edb75c50729b45e92c3ed54968bd5ab7b58af412d158e876d6d7649ea4ab18461b7be844c4eea27bbbb5bad4d52a9f5629d69ec13d18f6edef
- SSDEEP 12288:v2obhv3AqCXk7R+vD5AgVPMK+BemUCpY0:v2GdxQDDvPMrBhUCpl
- TLSH T1A0E46C52DB9800EBD476D630C1629615DB77B8D56B91DBCF0368BD3E3E266808C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e7:93:fb:7b:ab:c4:1a:91:03:b4:20:76:d6:22:96:b4:9f:3b:e5:b2:6e:86:28:05:43:0a:97:e9:db:a3:87:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 12, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:18:41:84:19:ad:cb:ad:29:4f:00:00:00:00:05:18
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
153872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
MipDlp.pdb
mpclient
MpUtilsExportFunctions
MpDlpReportRmsLabelInfo
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
kernel32
ReadFile
SetFilePointerEx
WriteFile
SetEvent
WaitForSingleObject
WaitForSingleObjectEx
LoadLibraryExW
FormatMessageA
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindClose
CreateDirectoryW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
LocalFree
GetFileSizeEx
GetSystemDirectoryW
GetCurrentThread
GetCurrentProcess
OpenSemaphoreW
ReleaseSemaphore
GetTempPathW
CreateFileW
LoadLibraryW
GetModuleFileNameW
CreateEventExW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetLastError
CompareStringOrdinal
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
HeapAlloc
OutputDebugStringW
GetCurrentThreadId
GetModuleHandleExW
HeapFree
GetModuleFileNameA
DecodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
CloseHandle
GetSystemTimeAsFileTime
FormatMessageW
GetProcAddress
FreeEnvironmentStringsW
GetEnvironmentStringsW
FreeLibrary
CreateMutexExW
ReleaseMutex
WriteConsoleW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetCurrentProcessId
GetLocaleInfoEx
InitOnceComplete
InitOnceBeginInitialize
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
GetStringTypeW
EncodePointer
LCMapStringEx
QueryPerformanceCounter
CreateSemaphoreExW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
ExitProcess
GetCommandLineA
GetCommandLineW
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
HeapSize
advapi32
RegCloseKey
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
RegCreateKeyExW
OpenProcessToken
OpenThreadToken
RegQueryValueExW
ConvertSidToStringSidW
LookupPrivilegeValueW
PrivilegeCheck
GetTokenInformation
TraceMessage
Name
.text
Size
316KB
Virtual Size
312KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
116KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
188KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=32595,
count=177, id=261, version=32595,
count=18, id=260, version=35207,
count=13, id=259, version=35207,
count=102, id=261, version=35207,
count=1, id=259, version=35215,
count=10, id=260, version=35215,
count=20, id=260, version=32595,
count=28, id=257, version=32595,
count=23, id=261, version=35215,
count=3, id=257, version=35215,
count=375, id=1, productName=Unmarked objects,
count=79, id=265, version=35215,
count=7, id=126, version=50727,
count=1, id=255, version=35215,
count=1, id=151,
count=1, id=258, version=35215,
MpClient.dll
- IMPHASH ea9f790d77bdb3c825864b5c3bffaf2c
- SHA256 b926d80dab87f47765f15d796a57bdbdb0e0acc9a4642b7834908e417d4ffb99
- MD5 f7bb9cd0f34080241b928ea426de87ca
- SHA1 4e9dee3e39bbf07adf32c80f79799fc5f36d74f5
- SHA512 802493b540cc5c473f8d31c45d8417c06462509f78570714c6e476fd92121dcc754e49004bf4ff8f9f9d287c0c9c54cb136a7ac0ada9d76816d123057d94fbe4
- SSDEEP 49152:ex2hvRhHukNM9sZMG8ZuDXFozlE/0DQvKKzhNCooasL:VvOBsZMG6uD1ozlaCKnCTp
- TLSH T18AC51219E7E501BEE0B7D2B8CD434906E7767C4A4771EADF03A096A61F233909E39712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8468
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateDirectoryA
DeleteFileA
GetFileAttributesA
CloseHandle
GetLastError
WaitForSingleObject
Sleep
CreateProcessA
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
DisableThreadLibraryCalls
LoadResource
LockResource
SizeofResource
FindResourceA
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32First
Process32Next
WriteConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
ReadConsoleW
ReadFile
CreateFileW
FlushFileBuffers
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
VirtualProtect
LoadLibraryExW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetStdHandle
shell32
SHGetFolderPathA
user32
GetCursorPos
ole32
CoCreateInstance
CoInitialize
CoUninitialize
MpClientUtilExportFunctions
MpClientUtilExportFunctionsSize
MpDlpCheckAccessForBuffer
MpDlpGetDeviceInformation
MpDlpReportRmsLabelInfo
MpUtilsExportFunctions
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=149, id=261, version=33145,
count=6, id=259, version=33145,
count=9, id=259, version=35403,
count=14, id=260, version=35403,
count=31, id=261, version=35403,
count=14, id=260, version=33145,
count=1, id=262, version=33145,
count=9, id=257, version=33145,
count=110, id=1, productName=Unmarked objects,
count=1, id=261, version=35724,
count=1, id=255, version=35724,
count=1, id=256, version=35724,
count=1, id=258, version=35724,