MALWARE_DO_NOT_EXTRACT_clickfix_midw_betland_google_cl_triage_upload.zip
- SHA256 c742aff6f36d2d6b5ec928d98c66089647c3a49e0657e40b45d059c011804ac0
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
run_default_rundll32.cmd
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
run_default_rundll32.cmd
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral3
Sample
run_syswow64_rundll32.cmd
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
900 seconds
Behavioral task
behavioral4
Sample
run_syswow64_rundll32.cmd
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
General
- Target MALWARE_DO_NOT_EXTRACT_clickfix_midw_betland_google_cl_triage_upload.zip
- Size 10.0MB
- Sample260702-dmw7csbt91
- SHA256 c742aff6f36d2d6b5ec928d98c66089647c3a49e0657e40b45d059c011804ac0
- MD5 a13362d67271b68dce8e3e1cb8a35f88
- SHA1 465f33e848da606819466a25f5a59ebc9a5291d7
- SHA512 cee8f73a46c214ab0046835d782fb6adc732b9580bae780c66b8ca1ec7f4ad96cb02bbde4c69be7c2c685b8cec863a646e26d9f4d45d30c93b93a7376756228e
- SSDEEP 196608:5h2QLY0PjMpqf6ErnbjeDp0kixPEUs/IXpr3hvHLqi7c8obeMTv6+yxIwPfXrxbS:54KBMq6EDRzg/EvLX7JO6+R+S
- TLSH T162B633AD611783DCB9495EEF67C59348EAB6D40D760B20D6AB4F449208C0CBCE8B7F15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/google.cl
File Explorer
-
MALWARE_DO_NOT_EXTRACT_clickfix_midw_betland_google_cl_triage_upload.zip.zip 10.0MB
-
google.cl.dll 13.3MB
-
run_default_rundll32.cmd72B
-
run_syswow64_rundll32.cmd90B
-
run_syswow64_rundll32.ps1.ps1 190B
google.cl
- IMPHASH 6c871eb5afcc648e749d578ab8277277
- SHA256 709bf0e0f074504e127f361554b2f215359c3fbbd1aa6a9969b4e6eb2b92a110
- MD5 73893e082ca34b2cc48a00a17b76ce16
- SHA1 c8c0f6f3a02d928cc58974e526fd6f388f6cf333
- SHA512 d84a55ca85e6e16e7428a01522cba3061e155e8291f752d75cc116d7f183e70cec48f30f4b3a1fbbe75ede1b1cee64c1b7a70632fbb54ace692e6d43bc2a7f7f
- SSDEEP 393216:GvlKcLUwXegCXzJ0EGrAlMZBPB7OGfpAN/p:el1gwOgozJ0EVMNCNh
- TLSH T1D7E6F1C773267DAED89C007D25DFF308859EBD38587089AA712890F866539928DE7F07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
12536365
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredExceptionHandler
msvcrt
__mb_cur_max
PDBFRepro
Name
.text
Size
234KB
Virtual Size
234KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
7.4MB
Virtual Size
7.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
861KB
Virtual Size
860KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
run_default_rundll32.cmd
- SHA256 29c12b50516222fd92fc5538c0f2b8f78489d2a696a73ec370465119e8128126
- MD5 3b6074d10acb338a13d49f85b7afe7fb
- SHA1 6440fb38bbc08b0070ddc4903e122bcc787ab03d
- SHA512 9d47d3f9e9ed0cf421c1c4f37b541862d7443ab59f32a76456d8555c4e007ba5ff12c3b7b04d443cd2c94bd609ecae33a6b1d10df0ed9eeb9613beed8797a216
- TLSH T175A0220320CB0202A000A0300C3230B8003EE00BAA0A8AE02800C2323EAE20382280C2
- MD5 SHA1 SHA512 TLSH
run_syswow64_rundll32.cmd
- SHA256 2bc0ea6419d614f3ef6424c9fb0737e66edd806ca1d11bd20aa35b165bf03d0a
- MD5 2018df29e43d3e5ed5878b112b3e6894
- SHA1 8afd3a544ba88e6bfa8da56eb4655fa56a7f5e73
- SHA512 4b9b95d64aa97c804bb45473671f472064ae5a613fe327031345ab482304f9c178dad80f61d9e801c31e8bd4b82024356d7a7531454fafdf29b2b2ab84f6903f
- TLSH T1CEB01203358B50017100943809222164021F900F790556E414008222685D52346580C0
- MD5 SHA1 SHA512 TLSH
run_syswow64_rundll32.ps1
- SHA256 c117200e90e9da389dbab312ef6251540e015f55d7a06099b0119ed9edb66dc0
- MD5 f565307d8518b495a26dba86f4f353fb
- SHA1 a7495f4af384f5a518150258886b92f66f1faca5
- SHA512 b3d844dee4007d438a3db390c0e9538833d5a9476d13802c8fa6ba5eb72209f2fb218863991c3475bc3eb60e0fc63ed3ac02398bfb95cd6f7277a4cb60ff63ee
- TLSH T183C0C008AE006485C0ECC1338090F20F4D1DD5BC103F2238041884102F33DF84BA4340
- MD5 SHA1 SHA512 TLSH