d856iw.zip
- SHA256 41dab506a9c84eaa1e250148d856b12846ede4cfec68e8d52afd0c4dea13c2fc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
plaguecheat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
plaguecheat.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target d856iw.zip
- Size 6.8MB
- Sample260620-qgwpvsfs2l
- SHA256 41dab506a9c84eaa1e250148d856b12846ede4cfec68e8d52afd0c4dea13c2fc
- MD5 dfa1dea72abf249ec6c2da26a25368df
- SHA1 5982433a4010fafe6f0a818d456e9b014ee8dd21
- SHA512 d95121c59e3cc86b27fdeca7da3e6e9ccf8c90a4f96a25c05b5e4ad3aa7f73bdfb81b2bc29d6c7c7f73fa885a434de099a8ec4ca4e2cdc8909c7ddc7089ffd11
- SSDEEP 196608:qM5s4n3sptdq5YecLM7FC5meVIAPT1EQH:q+znKUYeck0TL
- TLSH T1166633E3F874676CBBA5C2C369F7948269F0DA0DAE93081A710D69C24F6E2D70D97710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/plaguecheat.exe
File Explorer
-
d856iw.zip.zip 6.8MB
-
plaguecheat.exe.exe 7.1MB
plaguecheat.exe
- IMPHASH 8e16417de141aec85f09d38df1fc278d
- SHA256 d038ae96eb5a2445e15bdce9e6a2bf6ea226c29e76517b0524bbbac21da39d44
- MD5 2644780bc5c188734a35e6046ed503f8
- SHA1 5d284f99ab41fa5e825520ecb1761671010102fd
- SHA512 93f40eefac461b0e6fb39b45c443d2bc420c197d1f04c7c8ffd9517917df750c316b1e3fd17a10254d296767d018d7138307b081cdadfc272cc00cc28c65f979
- SSDEEP 98304:D8gDoHbPvc2DG4hCGCgrOSiNABZYZOpeTF2pgo9G7zi25PJupWrrdAcdq3sIS8Xk:DNA0nZSfBZYZee8p8rJup6EjS8XTde
- TLSH T1347623875760E9BBE380C5B0D4D9E7A606E0F63DDDA604113DA979CD3B0DB5408AEB32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15805698
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
d3d11
D3D11CreateDeviceAndSwapChain
ntdll
RtlAnsiStringToUnicodeString
advapi32
CloseServiceHandle
ws2_32
WSACleanup
kernel32
AcquireSRWLockExclusive
user32
ClientToScreen
gdi32
CreateRectRgn
shell32
ShellExecuteA
ole32
StringFromGUID2
dbghelp
SymCleanup
urlmon
URLDownloadToFileW
crypt32
CertAddCertificateContextToStore
imm32
ImmGetContext
d3dcompiler_47
D3DCompile
dwmapi
DwmEnableBlurBehindWindow
bcrypt
BCryptGenRandom
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
__sys_errlist
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
_itoa_s
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-string-l1-1-0
__strncnt
Name
.text
Size
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
814KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.hd-
Size
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.NBE
Size
512B
Virtual Size
496B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.7dN
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
60B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ