Test.zip
- SHA256 c49f340eb4e6884bf247dc8dc05d422b0aa2b0cd8201cda736aabb2017ebc3d5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Test/Injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
Test/Injector.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
Test/d3dll.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Test/d3dll.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target Test.zip
- Size 477KB
- Sample260623-m9klhsb18m
- SHA256 c49f340eb4e6884bf247dc8dc05d422b0aa2b0cd8201cda736aabb2017ebc3d5
- MD5 1ec35b74bdb576a5c86693011c8d953d
- SHA1 b0ae2d228021259782feefb50db2fa0841500e0d
- SHA512 7fa347f18f36fa5c80566ad7f4e68730c1e3462ce8af3ad2cc31fb165f4ececb41db16afd638184bfdaf796e673642f79656465dba2240645087800e133ed0cc
- SSDEEP 12288:3EpOTkc2wle9aajsfdX2NSHeSjR0Xfqk5A482E5m:36OTks6aSslGNS+AAL5Atm
- TLSH T1AEA4231D97401B0D6BF3B3143A889639AF5393C41928DDB57A9E778F0EE0C8396E109B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Test/Injector.exe unpack001/Test/d3dll.dll
File Explorer
-
Test.zip.zip 477KB
-
Test/Injector.exe.exe 65KB
-
Test/d3dll.dll.dll 1.1MB
Test/Injector.exe
- IMPHASH daa5a50f9ee1a3e0e08c676626655fc6
- SHA256 323c0aa7bd25032b53fdc721d396302f0a3031219404af07896b8d8a8e1ba982
- MD5 91fa4df7660562feba4310b7a193212d
- SHA1 23ffa098ae564840459b35562632ace51f430134
- SHA512 55e9c4a27cba7ce54a5f3f0d7c4f5ce6b66375f46d686d0820445eb5b8756e8f707f426a7c78024958474d8694ccbb1f8d151da1d3a2b62d642400491508e14c
- SSDEEP 768:6YOtVCLIz/D0DDmeDm+6roKwxy3zUwKt0LZTNB8vyzkeMoUzjgM//hTSXkMgM7A:vLI7D0eeDm+6EKUwKsZTNt4tsUqk
- TLSH T1FB531A2AD955506FD31ACD78CA538901DE63BC468BB1B6CF57405DDB0E26AE88F3D302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
36160
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\USER\source\repos\SharedData\x64\Release\Injector.pdb
kernel32
Process32FirstW
CloseHandle
CreateThread
Module32FirstW
GetProcAddress
VirtualAllocEx
GetModuleHandleW
CreateRemoteThread
Module32NextW
VirtualFreeEx
FormatMessageA
GetLocaleInfoEx
Process32NextW
GetFileAttributesExW
OpenProcess
CreateFile2
AreFileApisANSI
GetLastError
Sleep
CreateToolhelp32Snapshot
WaitForSingleObject
FindClose
GetModuleFileNameW
TerminateProcess
FindNextFileW
WriteProcessMemory
GetFileInformationByHandleEx
WideCharToMultiByte
LocalFree
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
FindFirstFileW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
user32
ShowWindow
RegisterClassExW
SetWindowTextW
GetSystemMetrics
SendMessageW
CreateWindowExW
DefWindowProcA
TranslateMessage
SendMessageA
wsprintfW
LoadIconA
PostQuitMessage
UpdateWindow
EnableWindow
MessageBoxW
GetMessageA
DispatchMessageA
GetWindowRect
LoadCursorA
SetWindowPos
PostMessageA
gdi32
DeleteObject
CreateFontW
advapi32
EnumServicesStatusExW
CloseServiceHandle
OpenSCManagerW
ControlService
OpenServiceW
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
comctl32
InitCommonControlsEx
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
__std_exception_destroy
__std_exception_copy
memcmp
memcpy
__current_exception_context
_CxxThrowException
__C_specific_handler
memset
memmove
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-string-l1-1-0
_wcsicmp
tolower
strlen
wcslen
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
terminate
_initterm
_get_narrow_winmain_command_line
abort
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=29, id=261, version=35721,
count=6, id=257, version=35721,
count=11, id=257, version=33145,
count=142, id=1, productName=Unmarked objects,
count=1, id=265, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
Test/d3dll.dll
- IMPHASH ea13965b2937064acd8f7b95791e6cc2
- SHA256 cb26bc69ccae61af76aff7d02f8bbdb249fefa77336422a3cecf0b5200208fe5
- MD5 8cda982dcd7e0baa8999f7861eb4b3c5
- SHA1 b63265a6e285f55e31d2238ded85c9e67c5d2f11
- SHA512 cadf45782d3dda97d0cb40f3a3176f501cdaaa0d2b174d920bf8f8b3367de22f78c2a67019fe666f73be038d47330bf5159b7b9753a6688b9904b154b8f11833
- SSDEEP 12288:LEQYjZtfmCMKzBu01/3wq/OXhYgcSqIMZEiC+nBb6ZgIdC:oVjzfmVKzd1/TOXhYgiTZEiVndyu
- TLSH T140359D42F1B941E8D47AA179918BBB5FFA35300417205BCF63D065882FB37E22AFA751
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9821
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\USER\Desktop\For Coding\repos\Hooters\x64\Release\d3dll.pdb
kernel32
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OutputDebugStringA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetModuleHandleA
LoadLibraryA
CloseHandle
HeapFree
DecodePointer
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CreateThread
GetCurrentThread
GetTickCount64
DisableThreadLibraryCalls
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
SetUnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryExW
LoadLibraryExA
SetLastError
VirtualQueryEx
VirtualProtectEx
RaiseException
VirtualQuery
VirtualFree
Sleep
HeapReAlloc
HeapAlloc
HeapDestroy
IsDBCSLeadByte
HeapCreate
VirtualAlloc
GetLocaleInfoA
GetSystemInfo
user32
MonitorFromWindow
LoadCursorA
ScreenToClient
SetProcessDPIAware
GetKeyState
SetWindowLongPtrA
ClientToScreen
SendInput
SetCursor
SetCursorPos
GetClientRect
ReleaseDC
GetDC
GetForegroundWindow
mouse_event
OpenClipboard
CloseClipboard
GetAsyncKeyState
CallWindowProcA
DestroyWindow
DefWindowProcA
CreateWindowExA
RegisterClassExA
UnregisterClassA
GetCursorPos
DefWindowProcW
IsWindowUnicode
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
EmptyClipboard
GetClipboardData
SetClipboardData
SetCapture
ReleaseCapture
GetCapture
gdi32
GetDeviceCaps
CreateRectRgn
DeleteObject
shell32
ShellExecuteW
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
d3dcompiler_47
D3DCompile
dwmapi
DwmIsCompositionEnabled
DwmGetColorizationColor
DwmEnableBlurBehindWindow
msvcp140
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Query_perf_counter
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
_Query_perf_frequency
vcruntime140
__current_exception
__current_exception_context
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
__C_specific_handler
memcmp
memset
memmove
memcpy
memchr
__std_terminate
strchr
_CxxThrowException
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-stdio-l1-1-0
ftell
__stdio_common_vsprintf_s
_wfopen
__acrt_iob_func
fwrite
__stdio_common_vfprintf
fclose
__stdio_common_vsprintf
fseek
__stdio_common_vsscanf
fflush
fread
api-ms-win-crt-heap-l1-1-0
_recalloc
_callnewh
calloc
free
malloc
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-math-l1-1-0
ceilf
acosf
sinf
sqrt
atan2f
log
logf
pow
fmodf
powf
sqrtf
cosf
api-ms-win-crt-string-l1-1-0
strncmp
strcmp
wcslen
strlen
strncpy
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
terminate
_initterm_e
_errno
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_initterm
Name
.text
Size
839KB
Virtual Size
838KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
165KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
284B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35721,
count=4, id=259, version=35721,
count=8, id=260, version=35721,
count=22, id=261, version=35721,
count=3, id=261, productName=VS2019 v16.7.5 build 29112, version=29112,
count=15, id=257, version=33145,
count=190, id=1, productName=Unmarked objects,
count=8, id=261, version=36248,
count=4, id=260, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,