bildschirmgymnastik.zip
- SHA256 9e2e6cc96dd89efc23eeeb8e107e9af52bee3e0d1cb6576909b1fd287d7dfbb3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
llb.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
llb.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
bildschirmgymnastik.scr
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
bildschirmgymnastik.scr
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target bildschirmgymnastik.zip
- Size 718KB
- Sample260608-wwj79set3k
- SHA256 9e2e6cc96dd89efc23eeeb8e107e9af52bee3e0d1cb6576909b1fd287d7dfbb3
- MD5 ff24b2d30a09b89d51ed3dbdb9d87571
- SHA1 ebf8d8c56ca5a0b3f261b89661a44d7fd621a280
- SHA512 bbce9cdfb4e6f93f8b03f1f377824773e417cb78532c92b178bf304767f146bfb518575feaa0ada73a475f100b9b0ef662b352ea1ddb01064e8e7ed86184eb25
- SSDEEP 12288:9445t/0yvr/HD4qx61d7GYNL2FWqRn371jh5nY6uF0vr8BzeSsguJnplnuckpWQd:9445tBHD4qx61MQaFJ71Pnkqr8BaSsXA
- TLSH T13BF4236DAAA00D61AA939F1E90FC8A721183F7F3254BEC06BDE415D26C30D5D8D47C6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/llb.dll unpack001/bildschirmgymnastik.scr
File Explorer
-
bildschirmgymnastik.zip.zip 718KB
-
llb.dll.dll 285KB
-
readme.txt1KB
-
bildschirmgymnastik.scr.exe 1.3MB
llb.dll
- SHA256 d5c7c080c9c10357170345c05925948c064f8e80f8772e7475cf2510a6427cac
- MD5 e9a5688efede7e2600668ec480038ae4
- SHA1 68f485262780eefcc2b239bf277de4b1450c6561
- SHA512 3bd7a740f9ae839b48310d610c7e43d9895742bfb25f0004d2ff5cbf0c2eddd755447888a9911463cf09bb47a98aa3a44a4c796dfea51b8f2ec2948bfd4224ba
- SSDEEP 6144:9f4XwjlR/4CYVh5eY24+lK2G1twc1EbhUoG0/HyybD6:9f4XwjXyeY240KTOk03f
- TLSH T1FE545B73F6E00837D1333A3D9D1B6B64E82ABE112A2C54562FED2D4C9F396817918397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
254912
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
HookOnKeyboard
HookOnMouse
HookOnPaint
UnHookKeyboard
UnHookMouse
UnHookPaint
Name
CODE
Size
245KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
194B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
readme.txt
- SHA256 1289a94bb3665bb00b6944b86126d406490b9378e4094a615b5a7e2321247ec8
- MD5 4d28f7be9992ee8c59f64edc68d43ba8
- SHA1 edc1d0ccb256d1346dd0791b3924f3ef59374229
- SHA512 fe8fd488c30f036eaac55d4d39565f0427b33306327fb1c342b06e6c72c2468c820842090b31732250e8b9439cab91d9ce003e997720700e26a6eeab20bc5c7b
- TLSH T13C31424DEB56D330627103D2222EBB2BA515D428417722CD24D0CB59B076543EA2BDDD
- MD5 SHA1 SHA512 TLSH
bildschirmgymnastik.scr
- SHA256 718b65cf119606da9cb9c30fcebb0bd56d0b0253794bafba4ecc6fc397da9d9e
- MD5 4ed0a7d66e66dbdd9a8f8d8385c71a17
- SHA1 50a971d81ca2b1475d0769b57b8ee424334950c7
- SHA512 22e207f94bab9e5f7cb0accdfb38ef7cb660b764867bb52f68871a9540a7378f0851544803a22828d9db46e7d324f0669c257be3cf012e6d97d54c5bca042610
- SSDEEP 24576:yLCKDcyxWDAg8uHa7IdyNx/WvsCzo3cCFhnWPP6OG6TngVTlBnG:yLCgDca7vKylFhnyL
- TLSH T1F7558D21F6919C77C1770438BD96A3E5D5687E361E2958863BE03F4C1E393913A382BE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
1050364
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
1022KB
Virtual Size
1021KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
18KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
37B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ