f11b60b273e2606e91832edbb014ad229563f5c537ddab11dba80018c11364dd.zip
- SHA256 99d35d154216cfdf1f69369c6811f273b58df08eb1606581b4e3e6d7da042598
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f11b60b273e2606e91832edbb014ad229563f5c537ddab11dba80018c11364dd.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
24 signatures
300 seconds
General
- Target f11b60b273e2606e91832edbb014ad229563f5c537ddab11dba80018c11364dd.zip
- Size 413KB
- Sample260621-ezenhsct9s
- SHA256 99d35d154216cfdf1f69369c6811f273b58df08eb1606581b4e3e6d7da042598
- MD5 f90bacc5d6ad4b2c1b0855cb3f2e85c7
- SHA1 e22ac77ef1ba4058d68b0a50debc5fbe4701376b
- SHA512 44f3576e646a3c412f937b75b277e20e9177cfbd0fe4aaa94165beb244fe34ff669466e38fcc50d716517b6f57c171b9126863536c2dbbbe3f4251030da1b288
- SSDEEP 12288:OmJwbhYHl1X+nMa1M3tfCwavmjSOrGwcgdsDoEJX:NJQYHr8GNCdvmrG1gqMEJX
- TLSH T10A94236768B8D91C38D913E59C46CACBB7FE4402FA72F5A98E74760FD3D1896368D001
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/f11b60b273e2606e91832edbb014ad229563f5c537ddab11dba80018c11364dd.exe
File Explorer
-
f11b60b273e2606e91832edbb014ad229563f5c537ddab11dba80018c11364dd.zip.zip 413KB
-
f11b60b273e2606e91832edbb014ad229563f5c537ddab11dba80018c11364dd.exe.exe 1.0MB
f11b60b273e2606e91832edbb014ad229563f5c537ddab11dba80018c11364dd.exe
- IMPHASH 9b9e1545a27f74c7e825990e6d713212
- SHA256 f11b60b273e2606e91832edbb014ad229563f5c537ddab11dba80018c11364dd
- MD5 b71956ba98abacf4b4dcc5a0453baaa2
- SHA1 81d5d6bec94a564b2d2734cf6fd53d84f14b274a
- SHA512 ce48361e7fb40e1bde5800b1220d49052a2d3923b4431fcae02d54a72e51f02ebe2767b3e30d7cdf31c4b53989f9b66a89973b23aa945f7d174137bdaffd11ea
- SSDEEP 12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTd7f:Vpp+Q+u5bUI8pij1NkshdMf99etb5p
- TLSH T1E4351941A4164AF6F6528ABD4922C12FEEF736050B10EAE75581B23E2F070ED2F7C759
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
577624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
WaitForSingleObject
PostQueuedCompletionStatus
GetLastError
SetEvent
TerminateThread
TlsAlloc
CloseHandle
QueueUserAPC
LocalFree
DeleteCriticalSection
TlsFree
FormatMessageA
ReadFile
GetFileSizeEx
SetWaitableTimer
TlsSetValue
SetLastError
WriteFile
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
GetCurrentThreadId
CreateEventW
SetFileInformationByHandle
DeleteFileW
CancelIoEx
SleepEx
TlsGetValue
CreateIoCompletionPort
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetDriveTypeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetCommandLineW
GetStdHandle
WriteConsoleA
GetDynamicTimeZoneInformation
Sleep
GetConsoleMode
GetFileAttributesA
GetSystemInfo
GetCurrentProcessId
GetCurrentProcess
GetProcessId
OpenProcess
ResetEvent
GetLogicalDriveStringsW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapSize
GetLocaleInfoEx
RtlPcToFileHeader
RaiseException
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetStringTypeW
WaitForSingleObjectEx
GetExitCodeThread
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapReAlloc
RtlUnwind
shell32
CommandLineToArgvW
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
ws2_32
WSAStartup
WSACleanup
shlwapi
PathIsNetworkPathW
mpr
WNetGetConnectionW
wtsapi32
WTSEnumerateProcessesW
WTSFreeMemory
rstrtmgr
RmShutdown
RmStartSession
RmRegisterResources
RmGetList
RmEndSession
Name
.text
Size
812KB
Virtual Size
811KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
165KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
33KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=27412,
count=19, id=260, version=27412,
count=181, id=261, version=27412,
count=1, id=262, version=27412,
count=16, id=260, version=32533,
count=10, id=259, version=32533,
count=3, id=261, version=32822,
count=23, id=260, version=32822,
count=100, id=261, version=32533,
count=19, id=257, version=27412,
count=205, id=1, productName=Unmarked objects,
count=9, id=265, version=32822,
count=1, id=255, version=32822,
count=1, id=258, version=32822,