New folder (2).rar
- SHA256 6878b98dff02eca7be8abe84dfec28f8602dab3725fa7e4e8aa2166d9972d85a
Password
rare
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New folder (2)/svchost.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
New folder (2)/svchost.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target New folder (2).rar
- Size 97KB
- Sample260629-v7kshacv9l
- SHA256 6878b98dff02eca7be8abe84dfec28f8602dab3725fa7e4e8aa2166d9972d85a
- MD5 10f5c7ead95e879365c9f5ab1033966d
- SHA1 e14426d904083b8b91c7ac0d95cdd4f46552a023
- SHA512 aaf61b2df2c80454fd49437405cc36efa3f56c77a6b9fbfdf792ef64a31ae30271c1aef6d1154728a64bb04b10e268f5bcce41c5935a2d5ec6d5dd8252e9faaa
- SSDEEP 3072:n0ewNByPjwZS4OsWXVdJw1fSW/nbQNRn6:n0ewMjQI5Vd+1KYnsX6
- TLSH T16AA312AFC1AA43B6A4CD9629758C86E7A2C47CECD60392F5666314502E9F372C43D18F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/New folder (2)/svchost.exe
File Explorer
-
New folder (2).rar.rar 97KB
-
New folder (2)/svchost.exe.exe 215KB
New folder (2)/svchost.exe
- IMPHASH 5f6ac8d6de4a4df5438de621b9e90c56
- SHA256 e5f95667b805475df592b58bc6db894d9148381c37d4f7ba20f58e1c69f7628a
- MD5 4bb4313b0c30032d5750bb2f56a92064
- SHA1 d94849fc0951453e3a9b75b9b3ab5b674e18252d
- SHA512 45eb622c2525abd44dd4f411312721d7ee7b08d577e1f564a020b412e33ccbf6b07412eaa655d981993fe8ea6f9fa5ad0564dc05d9b543cfc201a1346b4a8f05
- SSDEEP 3072:reDBuwp3fy9WcCbtpPzL5HzIz/joXPFPQoCb18M+O0bdKTXkTj:reDBuwp3fHbtpPzLJ2cXFQoYy1P
- TLSH T191246C1AB3941DFDE4778179C9920942E7727C5507A0DADF07A042B69F237E09E3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
rare
Minor OS version
0
Major OS version
6
Entry point
37988
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winhttp
WinHttpOpen
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
ole32
CoInitializeEx
CoCreateInstance
iphlpapi
GetAdaptersInfo
ws2_32
freeaddrinfo
getaddrinfo
gethostname
inet_ntop
user32
GetMessageA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
ToAsciiEx
GetKeyboardState
ShowWindow
DispatchMessageA
TranslateMessage
GetKeyboardLayout
advapi32
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
GetUserNameW
GetTokenInformation
OpenProcessToken
RegDeleteTreeW
shell32
ShellExecuteW
kernel32
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FreeEnvironmentStringsW
GetCommandLineW
SetFilePointerEx
FindClose
GetEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
GetConsoleOutputCP
FlushFileBuffers
GetConsoleMode
HeapSize
HeapReAlloc
CreateFileW
WriteConsoleW
FindFirstFileExW
LCMapStringW
CompareStringW
GetFileAttributesW
GetVolumeInformationW
SetFileAttributesW
IsDebuggerPresent
CloseHandle
GetLastError
CreateMutexW
Sleep
GetCurrentProcess
CreateThread
CreateProcessW
GetTickCount64
GetSystemDirectoryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
CopyFileW
GetComputerNameW
MultiByteToWideChar
WideCharToMultiByte
GetConsoleWindow
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
QueryPerformanceCounter
WakeAllConditionVariable
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
GetTimeFormatW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
ExitProcess
HeapFree
HeapAlloc
GetFileType
GetTimeZoneInformation
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
GetDateFormatW
Name
.text
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=156, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=54, id=261, version=35207,
count=19, id=257, version=33145,
count=185, id=1, productName=Unmarked objects,
count=1, id=261, version=35228,
count=1, id=258, version=35228,