New folder (7).rar
- SHA256 ce82f5b5aed2713021b0dc232a22529c7bd94dad28611f673fe9c45f762b4c81
Static task
static1
1 signatures
General
- Target New folder (7).rar
- Size 2.6MB
- Sample260628-ws51kabt9m
- SHA256 ce82f5b5aed2713021b0dc232a22529c7bd94dad28611f673fe9c45f762b4c81
- MD5 4303386bfba772bd534a22f209f72c44
- SHA1 7e310f0e035575e0bf9856986d321d2edcf024f7
- SHA512 79314d2917978c93182a60a7e44af15db66cd1fb485d6f85593395c6597e35ec5c9190e6bfda24f36c4e77a82f78ce65b3bd3a9cead057f473d91c800efbb8db
- SSDEEP 49152:ZtW9JoOXT6dincZqIiMWMkGTX1fz9L/yDCxlc3q5p++UDxmts8kC0vbJa6tVweV:P4JHI8YqI2GbRRgtq5TUVmtKv1a6tVw8
- TLSH T108D5330058BACBC3EB87873FE88EAF7A635F6F03720036955C80A9566ED287513657C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/volt-headless-p2.exe
File Explorer
-
New folder (7).rar.rar 2.6MB
-
config.json303B
-
volt-headless-p2.exe.exe 8.5MB
-
volt-headless.settings.json3KB
config.json
- SHA256 bf039ed1e55ca7d2d0642e11c6ecdec4ea58ab926a2193b4f5694673649a265d
- MD5 6b265416db0a91c9592ae6a7cc9fed07
- SHA1 b442b07ce4b29b4caac3cc121037b2f29c829cab
- SHA512 1abafff8aa8387ff183e8f6b3003650d62d38229672560ee6b37884fd4b48934858897c29eb95a16cf9ae34ea205621eb4b8a05e97b29930cdfe96985b1074cf
- TLSH T107E07203DBDCC46324D2005DDAC7A603A8CF0C9A8244BE1CBE278E80035402B0FF4818
- MD5 SHA1 SHA512 TLSH
volt-headless-p2.exe
- IMPHASH 58001f64d1ae21ba3be48af321d16aaf
- SHA256 e3cdb82863df23fe068faf45403632aecfd04af4c6b6eb753bae13ccbaabb476
- MD5 1d814ba05a6621900643d7809c1c2734
- SHA1 b3c211d059ee479868b7033790b362e61ef66d27
- SHA512 f674ac62a38e0fc07d6e858b987124c06161239526b5435f10ddc396ee2918b00272bc84e0d94a92ec33d258f81d899fef7454d26a333fba058b37e237894ddc
- SSDEEP 98304:8rKK6PzhSEWGLapUeZywJkHGwn+oh++Pk/o:8WemvGwn+ohG
- TLSH T1CF965B07BB9A45E9D1FAC834C2524667AA3170DA0B31EBEF46C5051A2F26BF49F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4995676
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
volt_headless.pdb
advapi32
RegDeleteValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetTokenInformation
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SystemFunction036
RegCloseKey
RegCreateKeyTransactedW
RegOpenKeyTransactedW
ntdll
NtCreatePagingFile
NtOpenFile
RtlNtStatusToDosError
RtlUnwindEx
NtCancelIoFileEx
NtDeviceIoControlFile
NtCreateFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtWriteFile
NtReadFile
NtCreateNamedPipeFile
RtlPcToFileHeader
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
crypt32
CertFreeCertificateContext
CertDuplicateStore
CertDuplicateCertificateContext
CertGetCertificateChain
CertAddCertificateContextToStore
CertDuplicateCertificateChain
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
kernel32
FlsGetValue
FlsAlloc
PeekNamedPipe
GetDriveTypeW
CloseHandle
GetProcessHeap
FlsSetValue
HeapAlloc
GetModuleHandleExW
GetStringTypeW
SetEnvironmentVariableW
GetCPInfo
GetLastError
FormatMessageW
LoadLibraryExA
HeapFree
FlsFree
GetStdHandle
GetConsoleMode
GetFileType
SetConsoleMode
GetActiveProcessorCount
GetSystemCpuSetInformation
CopyFileExW
GetCurrentProcessId
GetCurrentProcess
GlobalMemoryStatusEx
GetSystemTimes
GetFileInformationByHandleEx
SetFileInformationByHandle
SwitchToThread
MoveFileExW
FindFirstFileExW
FindClose
OpenProcess
SetProcessDefaultCpuSets
SetProcessAffinityMask
SetProcessWorkingSetSizeEx
SetProcessInformation
SetPriorityClass
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
SetThreadStackGuarantee
GetCurrentThread
HeapReAlloc
GetOverlappedResult
WriteFile
PostQueuedCompletionStatus
ReadFile
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
LCMapStringW
CancelIoEx
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
OutputDebugStringW
GetCommandLineA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
CreateFileW
GetModuleHandleW
GetProcAddress
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
GetCurrentThreadId
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetConsoleOutputCP
WaitForSingleObject
WriteConsoleW
FreeLibrary
ReadFileEx
SleepEx
WriteFileEx
EncodePointer
SetHandleInformation
RaiseException
CreateThread
GetModuleHandleA
GetFullPathNameW
SetFileTime
GetFileInformationByHandle
ReadConsoleW
GetSystemTimePreciseAsFileTime
CreateDirectoryW
TlsFree
CreateEventW
CancelIo
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetModuleFileNameW
DuplicateHandle
WaitForMultipleObjects
GetExitCodeProcess
DeleteFileW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
IsDebuggerPresent
InitializeSListHead
FindNextFileW
SetConsoleCtrlHandler
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetEndOfFile
HeapSize
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
TlsAlloc
TlsGetValue
TlsSetValue
GetFileSizeEx
ExitProcess
FlushFileBuffers
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetProcessMemoryInfo
AddVectoredExceptionHandler
GetCurrentDirectoryW
lstrlenW
MultiByteToWideChar
GetEnvironmentVariableW
QueryPerformanceFrequency
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetCommandLineW
FormatMessageA
GetStartupInfoW
GetSystemTimeAsFileTime
TerminateProcess
IsProcessorFeaturePresent
SetStdHandle
oleaut32
SysStringLen
SysFreeString
bcryptprimitives
ProcessPrng
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
ws2_32
connect
WSASocketW
getsockname
WSAStartup
WSACleanup
getpeername
getaddrinfo
freeaddrinfo
recv
send
WSAIoctl
getsockopt
listen
bind
ioctlsocket
socket
closesocket
WSAGetLastError
accept
shutdown
WSASend
setsockopt
bcrypt
BCryptGenRandom
secur32
DeleteSecurityContext
FreeCredentialsHandle
EncryptMessage
FreeContextBuffer
AcceptSecurityContext
InitializeSecurityContextW
ApplyControlToken
DecryptMessage
AcquireCredentialsHandleA
QueryContextAttributesW
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
370KB
Virtual Size
379KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
244KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=185, id=261, version=33145,
count=23, id=260, version=33145,
count=9, id=259, version=33145,
count=1, id=253, version=35207,
count=10, id=259, version=35207,
count=17, id=260, version=35207,
count=42, id=261, version=35207,
count=32, id=261, version=35227,
count=215, id=260, version=35227,
count=9, id=257, version=33145,
count=246, id=1, productName=Unmarked objects,
count=41, productName=Unmarked objects (old),
count=1, id=258, version=35227,
volt-headless.settings.json
- SHA256 db1d74651dec27085ef2da1333c3e2335413364723b9122754a3cffe6c31a5ab
- MD5 cfef948c1d96f89c07b45229791a969d
- SHA1 7d19fbfeb5ab436599dfd99903a7db8d53b3c0c1
- SHA512 8e472aabe79463d93135bd72d0cebcbca7660f715e97a52f265b2c31693967bbd4e9c06db03a32f08dbe1a076cd470cfa11326e12ce96efd41d18a7b1e3ad0d6
- TLSH T1DB615612EEF087761CA165149B8D23835F020809126BBD79D9ED411D320E53EA7FF9EA
- MD5 SHA1 SHA512 TLSH