Analysis
- max time kernel
898s - max time network
424s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/06/2026, 09:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
gaffarexecutor.rar
Resource
win10v2004-20260513-en
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
gaffarexecutor.rar
Resource
win11ltsc2024-20260618-en
15 signatures
900 seconds
General
- Target gaffarexecutor.rar
- Size 41.1MB
- Sample260628-ldcelagw4j
- SHA256 0822c4f9a3696ffed69feed7700ed6f5a9f63ba000a67af2e54beb4e6ccaa0dd
- MD5 9b736ebb1eb2fb347379e322e9f989db
- SHA1 60a9916857623e55521b978aff65f40d77e891b8
- SHA512 20c5e7f14991264ca9ece05506237869ff856d19b1da71a975ffc831cb7f5cf5c592b1e9440c39b8661b9cadea286d8e31ee905bbc4f35a94a45e18bfcfab99d
- SSDEEP 786432:SEI+eS8Tqlu44mAWZ3CVZ0dnbteykk56iKwoXw56yIVP+3Eng:7I8VjgVsRbn5hKwoA5CVqZ
- TLSH T1B99733470F45EF75A123B9BD409D781DC7BFDB42DB0468CE8A1EA8824FE4B658EB5810
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4556 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4556 7zFM.exe Token: 35 4556 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4556 7zFM.exe