pro.zip
- SHA256 f7b099049e88c0ddb3d14645dbe74fcd104299e2650b6f95b7fb3015769e2bb1
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
pro/666sysEmx.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
pro/666sysEmx.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
pro/private.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
pro/private.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target pro.zip
- Size 951KB
- Sample260522-sdlftshs2w
- SHA256 f7b099049e88c0ddb3d14645dbe74fcd104299e2650b6f95b7fb3015769e2bb1
- MD5 7b86c7336d4878b00dfbcc3a90b25386
- SHA1 d6d82fd737b50915950ae9675e25851160eea484
- SHA512 f3f8482ab21f816dc2013cd95b82a678eef24c87db91baec575f0366ecb16e93ab2b20c296b1c471a53215b35f00fe715504cae91a7056b39a33c08d6a4761d0
- SSDEEP 24576:Q/f7BxFAWTiPIkqjjxl04P2kuacKF7Z/2T1koVcTvoAWKog:8f7Bx+chkqPFP2scKFFU1U8AW1g
- TLSH T1212523C3B1746E79943F1B62013AAFB180DECBB36469F43690819E438885E5723EEF55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/pro/666sysEmx.exe unpack001/pro/private.exe
File Explorer
-
pro.zip.zip 951KB
-
pro/666sysEmx.exe.exe 34KB
-
pro/private.exe.exe 2.0MB
pro/666sysEmx.exe
- IMPHASH 33b1de1f7d3c6779c52e7853b227dc79
- SHA256 d220e547fdca500b55569871d85f558fcc32de07fbe1d8f3d4e3aff00fca37d3
- MD5 78d49e1dfe21c04fba6ebd1bde9d14d9
- SHA1 a043f9947ee1cdb9837e3bfa2b87a9424aaf61f6
- SHA512 f99ede7a77889da270f91e81bd944d4b01d024adcf141e930dc2ad80c13dfb2555b8d91871bd8d372fac3e2b8d8eefc680df119cb61518d9cad956e329b06dbc
- SSDEEP 384:rf7co3F7Qe1ge2LFbG+55TbUIFOy8he1VVflutQK3Len0aStl:j7bdQq9K/Tjcyg2lyQ2Loal
- TLSH T1F4F22B453FF54CEEE9EF4ABA5C70D1841635E8526E70EB1EB061928C09637C0E992F86
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10391
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\x0x0\Desktop\Neuer Ordner (65)\666sysEmx\x64\Release\666sysEmx.pdb
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
abort
_configure_wide_argv
_seh_filter_exe
_cexit
_initialize_onexit_table
_set_app_type
_get_initial_wide_environment
vcruntime140
__FrameUnwindFilter
memcpy
kernel32
Sleep
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.nep
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
708B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=2, id=259, version=35403,
count=6, id=260, version=35403,
count=25, id=261, version=35403,
count=4, id=257, version=35403,
count=2, id=257, version=33145,
count=45, id=1, productName=Unmarked objects,
count=2, id=261, version=35724,
count=1, id=255, version=35724,
count=1, id=258, version=35724,
pro/private.exe
- SHA256 4f1bb49a7d8d738a5c402085657bc17b4285d0d3bf0eecd676a0cc66fe7a3482
- MD5 b59881318fa980e8c8e4dea2ddb659e1
- SHA1 b02dd697710f1e28cc3e62e1dadbb4da789d0254
- SHA512 4621903acd8696df0e81276b702e7725dc1bdd1347580db20f46bf1ed1d55ab4fc0edb2ef1eda3cdbc1e9b527445e28f1192880e70e1e460c982a07be0058a70
- SSDEEP 49152:aDN/j4depZ+BhQOLUWC7MdkqXfd+/9Ao04dwteeY9keOtVKUAVbqv:aSsMdkqXf0FOA
- TLSH T19BA57F7C73D55D10FAFC52B49296EE51F120E4830D56A51C2C8F3A82A6E1A836ECF19F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ