tmpkx4973ah
- SHA256 3d1aa5ed6c701f252b778ea0ec4d1dd461fce3df373b6c693f88f06320cd9b07
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpkx4973ah.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpkx4973ah.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpkx4973ah.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target tmpkx4973ah
- Size 1.9MB
- Sample260602-cmefwacy7j
- SHA256 3d1aa5ed6c701f252b778ea0ec4d1dd461fce3df373b6c693f88f06320cd9b07
- MD5 69cff813c7e21294fdafe25969dcf9fb
- SHA1 13dedd43453b678c4ebbf3f6bc153adaf3f848ed
- SHA512 d0990050599af787bae0f25d22e8f0150aeddbb5f7e10d20b2727a34cb8f361f7c14fc962a69f5fed1452d4b5a458927802993266337a982ce552c340ef65323
- SSDEEP 49152:vW9vSwuk4s96gz7dwkUPvc5x7OZj2dDP1LkOKp5+Fs:vopuk4s9pxwPvJ2P1VKb++
- TLSH T1F395336E31BBEE884C4679319476349732378EE2CC39FCB1984AA65C7E246779306437
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/f204f90627a08dbe68547e8eefe5fc8961f39e728d007bf10b06f5c8433aad51
File Explorer
-
tmpkx4973ah.zip 1.9MB
-
f204f90627a08dbe68547e8eefe5fc8961f39e728d007bf10b06f5c8433aad51.dll 2.7MB
f204f90627a08dbe68547e8eefe5fc8961f39e728d007bf10b06f5c8433aad51
- IMPHASH 5db2063dfb007eb1a4ef12e2336e6e3a
- SHA256 f204f90627a08dbe68547e8eefe5fc8961f39e728d007bf10b06f5c8433aad51
- MD5 e1f6546ebc8d9a299c292a540439a62c
- SHA1 ca30fc1df691bed72b69055bcdf26604ae52618a
- SHA512 8c7d87017c003c50fc873f4e150f39535865debfa0c8426e08fb62637697e63b46a99d1c3014a51f809f2f25719b901a2a3aee96efda159b33aa8a13695d8f5a
- SSDEEP 49152:vvjBHx3diZ5SvktSkn6/J3+FkEQTRfDPGbB22vBhzahro2cpJbRARYEPNR:s5DtSxOFFQTRfbG122vvzAo2cpJbRAes
- TLSH T11DD59D0A6F3B4B9AD514C4BE967B1263C959BD0CD028B9748DC04B417F96F6092BE3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
1691104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
ExitProcess
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetModuleFileNameW
WriteFile
GetCurrentProcess
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryW
HeapReAlloc
GetSystemDefaultLocaleName
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
DeleteCriticalSection
HeapAlloc
lstrcmpiW
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
DecodePointer
GetModuleHandleW
GetProcAddress
Sleep
HeapFree
FlsAlloc
GetLastError
SetLastError
FlsFree
FlsGetValue
EncodePointer
RtlUnwindEx
GetCommandLineA
HeapSize
FlsSetValue
GetCurrentThreadId
user32
GrayStringA
ValidateRgn
InvalidateRect
ToUnicodeEx
SetRect
SetScrollPos
DialogBoxParamA
MapVirtualKeyA
HideCaret
IsWindowVisible
GetWindowThreadProcessId
CharUpperA
IsGUIThread
GetKeyState
GetMenuState
RealChildWindowFromPoint
GetMenu
GetTitleBarInfo
GetClipboardData
AnimateWindow
IsCharLowerA
GetLayeredWindowAttributes
GetScrollBarInfo
DrawAnimatedRects
GetDCEx
BringWindowToTop
CharLowerBuffA
SetSysColors
DrawTextA
MessageBoxIndirectA
CharUpperBuffA
CheckMenuItem
IsHungAppWindow
GetLastActivePopup
RemoveMenu
InsertMenuA
ShowWindowAsync
PrivateExtractIconsA
gdi32
AnimatePalette
ole32
OleRegGetUserType
CoResumeClassObjects
CoGetMarshalSizeMax
CoRevokeMallocSpy
CoGetInterfaceAndReleaseStream
GetRunningObjectTable
CoGetTreatAsClass
CoGetObject
CoGetCallContext
OleGetAutoConvert
CoMarshalHresult
CoGetCurrentProcess
CoWaitForMultipleHandles
CoIsOle1Class
CoTestCancel
CoCopyProxy
BindMoniker
IsAccelerator
OleGetIconOfClass
gdiplus
GdiplusStartup
AlphaBlend
DllInitialize
GradientFill
TransparentBlt
vSetDdrawflag
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=51, id=170, productName=VS2010 build 30319, version=30319,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=123, id=1, productName=Unmarked objects,
count=1, id=261, version=34435,
count=10, id=171, productName=VS2010 build 30319, version=30319,
count=8, id=158, productName=VS2010 build 30319, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,