5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5.zip
- SHA256 bc6c29292bce817996d1de1d3578adf6589d6ccedba53f8b424c797f3deb5b8e
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5.zip
- Size 92KB
- Sample260702-dnfk1abv2s
- SHA256 bc6c29292bce817996d1de1d3578adf6589d6ccedba53f8b424c797f3deb5b8e
- MD5 29e6889bb4a06859d4925647e696a769
- SHA1 4bc49032e74e97829dc3e8a2d386461346401da9
- SHA512 31fd5599ced7b272e420370c5623ef7108deac40bdb70dddbfec3163b77da98cbc25e922e88f2b228544e2b7f4b4a55d97037de92cbf5c13684131a9b1270308
- SSDEEP 1536:09iZbHSJycP93mIWy8mWcp6XOJDEn1pA6MUG1xrAQRwhGp0NU8m/2Ks2:ntOb8mzo+VX6Md1Z5aQOa
- TLSH T16F931214986E6121ADCEF5578F068FCB492DFBAC4CF80B43DDB452693A372419FB2990
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5
File Explorer
-
5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5.zip.zip 92KB
-
5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5.exe 92KB
5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5
- IMPHASH 9bb6616bf0c48e8ab4eacc9fe6b4345d
- SHA256 5b558a91c645d132300eb9261cf7e49f6392748252845e11248e8236dbb432d5
- MD5 ebcb39cd30b58654d6f7dbbb32683fd3
- SHA1 21ee7b4bbb23415a7dbfe1776c98cc5379c5d795
- SHA512 f61876857d49c375609c1670ca4b48ba2e4c9955162665cc016ce0efc3c08c149b0ae6bdca0e2ee3186875df126a01d1afae85f727be2d26a536e7af03d0ae41
- SSDEEP 1536:m7TP1hye3vtPUM/wZKJp4j6YBV0ifurjKhGchPUtRuMQ:m7TP1Me3vtPUMdbSDLKrjKhGchPUvTQ
- TLSH T12393E54D96AE61B8D356D8F4F1FE4A30B7217DC00C2E96A9425085E01EF55F0AE2CDBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CloseServiceHandle
ControlService
EnumDependentServicesA
OpenSCManagerA
OpenServiceA
QueryServiceStatusEx
kernel32
CloseHandle
CreateFileMappingA
CreateFileW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
FlushFileBuffers
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetCurrentProcessId
GetDriveTypeW
GetEnvironmentVariableW
GetFileSizeEx
GetLastError
GetLogicalDrives
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetSystemInfo
GetTickCount
GetVolumePathNamesForVolumeNameW
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalAlloc
MapViewOfFile
MoveFileExW
OpenProcess
Process32FirstW
Process32NextW
SetFileAttributesW
SetProcessShutdownParameters
SetUnhandledExceptionFilter
SetVolumeMountPointW
Sleep
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WriteFile
__C_specific_handler
lstrcatW
lstrcmpA
lstrcmpW
lstrcpyW
lstrlenA
lstrlenW
mpr
WNetCloseEnum
WNetEnumResourceW
WNetGetConnectionW
WNetOpenEnumW
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-multibyte-l1-1-0
_ismbblead
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
_set_app_type
__p___argc
__p___argv
__p__acmdln
_assert
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_initialize_narrow_environment
_initterm
_initterm_e
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
rstrtmgr
RmEndSession
RmGetList
RmRegisterResources
RmStartSession
shell32
SHEmptyRecycleBinW
ShellExecuteW
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
988B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ