18f33f1cb54fe347072cf720de5f022af69a7308cb98f0216345ec722c6f6e71.bin
- SHA256 18f33f1cb54fe347072cf720de5f022af69a7308cb98f0216345ec722c6f6e71
Behavioral task
behavioral1
Sample
test-main/file.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
test-main/file.ps1
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
test-main/nigga.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
test-main/nigga.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target 18f33f1cb54fe347072cf720de5f022af69a7308cb98f0216345ec722c6f6e71.bin
- Size 3.4MB
- Sample260519-kpsehsdt5j
- SHA256 18f33f1cb54fe347072cf720de5f022af69a7308cb98f0216345ec722c6f6e71
- MD5 40604fec5186df66deb861d262175365
- SHA1 c8fa049a4953fe398ee07d95bd7058c8b923331a
- SHA512 5f723459e44a0e04b8054d8aed595be2aed237b8aba7a731760c664152eaa0d67d0ed0377bade9fe39b3e3031f0ba39701052e815cfd37ccec72fa6389644774
- SSDEEP 49152:qqQHGvGAfZSplBTHs8ZRkXaih7BcA+CeNyAmQHhcvZ4B5lj2nfmUd0P/Av:LRS+8ZNOcm2cB4BLj2fmUdcov
- TLSH T166F5339B34637B4D952C3990EF3C8EA35AB769DDA225814EB3C44CD37DA11809F2B50B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 1 IoCs
resource yara_rule static1/unpack001/test-main/shellcode.bin family_donutloader - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/test-main/nigga.exe
File Explorer
-
18f33f1cb54fe347072cf720de5f022af69a7308cb98f0216345ec722c6f6e71.bin.zip 3.4MB
-
test-main/file.ps1.ps1 .js 7KB
-
test-main/nigga.exe.exe 1.2MB
-
test-main/shellcode.bin3.1MB
test-main/file.ps1
- SHA256 e0052de5a9673f74be5a49fe13cae9b16b6f271972901b17236090667bb53d31
- MD5 ec48225e2dfff54d8bbb9a23c96137d0
- SHA1 1749c7d673fb14504246b51ddd9e5cb51e0787b9
- SHA512 7f7bc4d1939967697785b735cc75404493a13fadca5c3a4cb71a3f94afe0e94fcc0356054fe2ada1e9aaaac6b225b61c7e507a2761032d4e29f3dc38888d2201
- SSDEEP 96:F9o11ft+114VSIoNckF073kmBWX/wAkqU1u2xBeH5af8nJlE:x14VSId3u/wA7UZxsH5K
- TLSH T1DDF122384208576949B2226AAB48C549FA5741F30BBF2E51F8CC82355F7605DE13AFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
test-main/nigga.exe
- IMPHASH 0a98343311b070c6ce1a4debb2e92254
- SHA256 71a7d0004e317f6787844347acdf4c910938820fd3f5476f6bd4bd7aeca34273
- MD5 a82e020ef218e0682f80ab3045ecfc06
- SHA1 4baacc6946988eb9fd552a627fc5c4f21067ebe8
- SHA512 2adc8616336409987781c5c7fbe262a28c458e11eaca589c46528d8ffb78c12b945088f189d29ca3e3c8fead4472940f5cfa712cde2eb4698bc47786fbead597
- SSDEEP 12288:NXH1DLdp3T9dZBTYRNY3EfxnXxM3dsRSiXhkypdQwcmemqvw9E8:jLdp3T9jd3dsROypdQwc/I9E
- TLSH T14A55A54BE7B611D1F4BAC139A562322AFC7234A58738D7D792859A0E5B30FE4AD3D700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
480811
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Hasan\Downloads\LOloveeni\file\x64\Debug\file.pdb
kernel32
CreateFileA
WriteFile
CloseHandle
CreateProcessA
CreateFileW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
HeapSize
HeapValidate
GetSystemInfo
GetStdHandle
ExitProcess
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetTempPathW
IsThreadAFiber
VirtualProtect
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetCurrentThread
HeapQueryInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
RtlUnwind
wininet
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
Name
.textbss
Size
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
985KB
Virtual Size
984KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
215KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
1024B
Virtual Size
535B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
1024B
Virtual Size
563B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=149, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35403,
count=17, id=260, version=35403,
count=51, id=261, version=35403,
count=5, id=257, version=33145,
count=97, id=1, productName=Unmarked objects,
count=1, id=261, version=35728,
count=1, id=255, version=35728,
count=1, id=258, version=35728,
test-main/shellcode.bin
- SHA256 1daadd56264c097f378459c3f4a345156a5a06ac08d8312a73be4a37964da43b
- MD5 3505478c9fb123d6287c841c7852a0ee
- SHA1 ecbef2098321c6882bf1d5dc92fd1ec88c536d02
- SHA512 6e6bf9db77b64bdb0bf3beabaad07cc66fff0b50863fb305deb5090b5400616946f259ecc1824fdd00b65f8c941edb2a3f690499a7dd75b2f8ff26cb6073d102
- SSDEEP 49152:aD9yFXZ/fu6JPC/UYp9BWAeCgbSeuod7cDt0Brll2HT+ErwZNMR:ahyy6JbyWYCcR0BBl2z+EraWR
- TLSH T139E533977563778D547C3990FE3C9AA3ABB7299C9225814F67C44CC32EA1150EF2B20E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader