PPT for Breifing at HQ Norther Command.zip
- SHA256 a9600cfc69d4960d2c7be6fe24203f30a3d945ba638b402efe843e56e7a8805c
Overview
overview
7Static
static
3PPT for Br...tx.lnk
windows10-ltsc_2021-x64
7PPT for Br...tx.lnk
windows11-21h2-x64
7PPT for Br...tx.lnk
windows10-ltsc_2021-x64
7PPT for Br...tx.lnk
windows11-21h2-x64
3PPT for Br...el.exe
windows10-ltsc_2021-x64
1PPT for Br...el.exe
windows11-21h2-x64
1PPT for Br...el.bat
windows10-ltsc_2021-x64
3PPT for Br...el.bat
windows11-21h2-x64
3PPT for Br...m.pptx
windows10-ltsc_2021-x64
1PPT for Br...m.pptx
windows11-21h2-x64
1PPT for Br...ce.bat
windows10-ltsc_2021-x64
3PPT for Br...ce.bat
windows11-21h2-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PPT for Breifing at HQ Norther Command/PPT for Breifing at HQ Norther Command.pptx.lnk
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
13 signatures
600 seconds
Behavioral task
behavioral2
Sample
PPT for Breifing at HQ Norther Command/PPT for Breifing at HQ Norther Command.pptx.lnk
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral3
Sample
PPT for Breifing at HQ Norther Command/excel/PPT for Breifing at HQ Norther Command.pptx.lnk
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
600 seconds
Behavioral task
behavioral4
Sample
PPT for Breifing at HQ Norther Command/excel/PPT for Breifing at HQ Norther Command.pptx.lnk
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral5
Sample
PPT for Breifing at HQ Norther Command/excel/excel.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
600 seconds
Behavioral task
behavioral6
Sample
PPT for Breifing at HQ Norther Command/excel/excel.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
PPT for Breifing at HQ Norther Command/excel/excel.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
600 seconds
Behavioral task
behavioral8
Sample
PPT for Breifing at HQ Norther Command/excel/excel.bat
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral9
Sample
PPT for Breifing at HQ Norther Command/excel/excelm.pptx
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
600 seconds
Behavioral task
behavioral10
Sample
PPT for Breifing at HQ Norther Command/excel/excelm.pptx
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral11
Sample
PPT for Breifing at HQ Norther Command/excel/office.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
600 seconds
Behavioral task
behavioral12
Sample
PPT for Breifing at HQ Norther Command/excel/office.bat
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
600 seconds
General
- Target PPT for Breifing at HQ Norther Command.zip
- Size 9.4MB
- Sample260629-fb13aads9t
- SHA256 a9600cfc69d4960d2c7be6fe24203f30a3d945ba638b402efe843e56e7a8805c
- MD5 bd260bf220b310ebdd9ab0b50114f627
- SHA1 599ce20ddf1a2c7aecfd7431702ca1ead3e50f4e
- SHA512 175d88c08fc8ea6d45daedab1e735ee2f6b2a6c6ca52972e9283eb4f2a288cae6688fd5cc939efe72022de2eb06408ab04e9699bed3da9930b33e7658a34cd09
- SSDEEP 98304:nIUWpHKb/s2UleTndXeDrSm/8F8vk+AIkMkk3unBA0pp2Wk+QF0F7LJPeXFwgI0k:IdpHKzs2zA8ulAfQ0BAL87l9SFITGwJ
- TLSH T1D3A612EC286034DE8DD30ECD7A9E42C9161A78505AAB35DE3B5C4771B7AAF5B097083C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PPT for Breifing at HQ Norther Command/excel/excel
File Explorer
-
PPT for Breifing at HQ Norther Command.zip.zip 9.4MB
-
PPT for Breifing at HQ Norther Command/PPT for Breifing at HQ Norther Command.pptx.lnk.lnk 2KB
-
PPT for Breifing at HQ Norther Command/excel/PPT for Breifing at HQ Norther Command.pptx.lnk.lnk 2KB
-
PPT for Breifing at HQ Norther Command/excel/excel.exe 25.5MB
-
PPT for Breifing at HQ Norther Command/excel/excel.bat373B
-
PPT for Breifing at HQ Norther Command/excel/excelm.pptx 9.2MB
-
PPT for Breifing at HQ Norther Command/excel/office.bat313B
PPT for Breifing at HQ Norther Command/PPT for Breifing at HQ Norther Command.pptx.lnk
- SHA256 3063285af5c7586ad04178c52b55da2bc1970cb7ae4fadba2195ad4a3fb8ac50
- MD5 a1cc2e62b076b037fc403f112b755ed6
- SHA1 dbcadfb99b1a36d3ddbdc83a6219ef5b77d0c6ff
- SHA512 2e0f99018423e4079da84dfa0ff964ef78b2e85d3c69cbe82835c9b73310bdb6cf74b180dbc056bdde4ca3d21e3715f19744229024f5e746c18ca8aa68b3efeb
- TLSH T10551CD0327FA8355D2B34B3119B6D3A58A25FE6DA852CF1F4398568E1DB2700DC31736
- MD5 SHA1 SHA512 TLSH
PPT for Breifing at HQ Norther Command/excel/PPT for Breifing at HQ Norther Command.pptx.lnk
- SHA256 1d68ae4327efaae00af169c6b4baf46bc262fe79cc99e290f97dfa812a6dfad2
- MD5 91ccb0232dd18dedfa7c54c3366a448b
- SHA1 6ffb078ac9054e887f5dddc0eb205b283429947b
- SHA512 20b8a285c3b311a4009a29d43443b9af629aa1836e90fbd1de5f1e901e0c3d6b72109d39148026378be632545663024b88b5528b448b575c3b805d520e802241
- TLSH T10751CB0327FA9355D2B34B3019B6D3A58A25FE69A852CB2F4398568E1DB2300DC32736
- MD5 SHA1 SHA512 TLSH
PPT for Breifing at HQ Norther Command/excel/excel
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 abfac8026d1974220871568caf9344cbffed19a184ff098c0912ffbb4f1e42d5
- MD5 c6409e078bad9094ab4b26dad5219f6c
- SHA1 f372511e07d474f2b4488603cc0a6fd4c780cd7e
- SHA512 5e981b64b3c0decd0b141fad55444e831eecaef2ef3b211e636e0997d5c42cac8644ce9c5a6903d3c4d1cecfd5d505288cb75942cdfad3d234deb2116d7de114
- SSDEEP 12288:vgeLTQTFTFTtTQTFTFTgTQTFTFTgTQTFTFTgTQTFTFTtTQTFTFTgTQTFTFTgTQT3:vPjxg
- TLSH T14F47C0CD484DA326D892DD2510ED2E2E275C24BBC94A2FB4ECBB3621D70D1D7DA234D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26738634
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\jrnswry acrhyis\jrnswry acrhyis\obj\Debug\jrnswry acrhyis.pdb
mscoree
_CorExeMain
Name
.text
Size
25.5MB
Virtual Size
25.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PPT for Breifing at HQ Norther Command/excel/excel.bat
- SHA256 befcffc4494e71f0efa03db4b3cfb71f72eab2ee9b406e867569062f238d4c3b
- MD5 d80d7e176600427c5e5c98d5b1e74147
- SHA1 75b2fad1540d2d37b3bb34dfd395bb1ebb0997a3
- SHA512 c46a6dec039b247792b6a0c99ccee92c6985261310b0907a4a7178389f41d0651201f12446c12eba6e73a8e851a8698ffc3453be1950ebeab9974251f148a010
- TLSH T114E0924418EA6BD31EC517A83B1CDB41D242DC0D1788486796C8DA4D8502E88B4E8755
- MD5 SHA1 SHA512 TLSH
PPT for Breifing at HQ Norther Command/excel/excelm
- SHA256 853ed3a26188e4cd89db50ebf50dd0c7b9392c056f637ba3af042c0156877a65
- MD5 d0b3d38a9f3527ad2e972e236616f2f2
- SHA1 5915d322f191cbea4066961243eb23524c8e0b90
- SHA512 5230f774591652dedf6c02bb89a588fbaf782505b657aab15d58f9a8343a4a0fca2fd86624f0e0273f76b0dee534b20ee814b704693f4cdc42b979fe53a7be5f
- SSDEEP 196608:c2g8s86LIFe1lS15LFYHEUlgHlqfeRGoC4L:c2g8s86LIFyU1NUBDIL
- TLSH T15CA63338D75224FBCA2A52364CFFA95044711DB067D9A28C7288FA447BFD6534870BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
PPT for Breifing at HQ Norther Command/excel/office.bat
- SHA256 751aba47221f97a8eb44dd137213cb1039e80d08ddc7ae059836ff3fb49fea8e
- MD5 94bfc9ea1ad3c2f31f540588d42eeb9a
- SHA1 9900fef5013465df5529718921ced8ca31f4100a
- SHA512 969e7c8eb89f91c0c1629f6700191d6f900291f0dc57543fae0212dd8dfeeb690a75cc02eab3f8285812ee054d6740a2a18a0b95693c123aff12e2412b07c9d0
- TLSH T187E0864118F227C2277645844B4C8F40A222CC4E638C4B26A5CD874E8846ED8B8A8B68
- MD5 SHA1 SHA512 TLSH