tmphzmgdw0u
- SHA256 ea28a1c094a552d032d5cfdebc1e9a4b1b37954ca18376e435e62a51eefce420
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmphzmgdw0u.rar
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmphzmgdw0u.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmphzmgdw0u.rar
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target tmphzmgdw0u
- Size 15.6MB
- Sample260702-nxpkdahs5w
- SHA256 ea28a1c094a552d032d5cfdebc1e9a4b1b37954ca18376e435e62a51eefce420
- MD5 83a024340117423f41e1464f1181eb3e
- SHA1 f6fcb83b2d61c259d3269e8be0ee960c6ae53d7e
- SHA512 dc00ded0edbc933f0aa247c4cc6b585b07035435ee204c9e8afba48286574bc61f6887d66bdc8fc70317d68f01356a38181629d4e34df1e58edfbca61a643ee7
- SSDEEP 393216:iUkODtlD14Gb+cn9cnbcF+K1Jg5zRzLYT1:iUl14k+cn9cnYb1Gdlm
- TLSH T1EDF633BF0A7F1BCB15CA097E49A4AA351766C92615D97380F46B19CC848FDDB2F0FA10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Zeus Grabber/Zeus Grabber/Zeus Grabber.exe
File Explorer
-
tmphzmgdw0u.rar 15.6MB
-
Zeus Grabber/Zeus Grabber.rar.rar 15.6MB
-
Zeus Grabber/Zeus Grabber/Password.txt128B
-
Zeus Grabber/Zeus Grabber/Zeus Grabber.exe.exe 15.8MB
Zeus Grabber/Zeus Grabber.rar
- SHA256 c5575546eec521809b0dcb2f2055149fb49e304bbd0bd64fe6de0d216bf96e6c
- MD5 b12c993890e187485d57d2d9f4e0c4ce
- SHA1 352835bde4e29ca19987f7f48cb9487f5a6d692a
- SHA512 eb3788a583ee3393394d7b6df80bae9e39dc2893b7cbb1c5012c10bf8b45fd70f6e281b06d58fd6bfac2a1e4cd3c69a31d77ab7533d75e4e8166a8cf9e8d53cf
- SSDEEP 393216:3UkODtlD14Gb+cn9cnbcF+K1Jg5zRzLYT1:3Ul14k+cn9cnYb1Gdl4
- TLSH T122F633BF0A7F1BCB15CA097E49A4AA351766C92615D97380F46B19CC848FDDB2F0FA10
- MD5 SHA1 SHA512 SSDEEP TLSH
Zeus Grabber/Zeus Grabber/Password.txt
- SHA256 213e0ab795837a615a35bc421b8d9de28ea1f68a364f5869f3658b700fd2c185
- MD5 264c1f95363bcaf61111c8a0d5fe690b
- SHA1 f2ec8b0ec668cf2e73c49f81bd83fff8ff9cc497
- SHA512 226cbd999d288ad2dd6a9efb0a749f1cdc3046114e10c71b3dd19f1be84ce380a6dbd6eeba86194fbe6f45fd894283997f04bf7cee462eeeb9bb6ca4f16a2617
- TLSH T1B6B0924F7A2F88B60318C9121368AC5AF257A8C6D96248CEB5912B4B577E2C0C4BC41C
- MD5 SHA1 SHA512 TLSH
Zeus Grabber/Zeus Grabber/Zeus Grabber.exe
- IMPHASH b1c5b1beabd90d9fdabd1df0779ea832
- SHA256 aed075d481108b7b78b3d497ae8960664a396cde21ced173ace6551710fd49f9
- MD5 fecb7116b75daa794779145cb5dfe143
- SHA1 7de26d122376e9c2527ccd32bc2e8476feec55be
- SHA512 8bf51b6a6fca821e38cd282229fcc3187b9320214a086cb239b6bfc59aa07c320aa5247ac2ed92083832bdcb18c6379d70ad0932712cf3a865fa72072cada547
- SSDEEP 393216:LEoKuJXQixSBXAobbhCAScOp/6ojDR3oqE4BgKTLaBqu5G91P51Cg6Q:LEoKuxQiuAo/hTrU/6onKq9aBqu5G91j
- TLSH T195F63306E2F615ECF5FBA5789C62490AC7377C0A0371954F267D426A0F333A9993A7C2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
208608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb
kernel32
LocalFree
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetCurrentProcessId
CreateDirectoryW
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
GetVersionExW
GetModuleFileNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
ExpandEnvironmentStringsW
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
GlobalMemoryStatusEx
LoadResource
SizeofResource
GetTimeFormatW
GetDateFormatW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetNumberFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
GetStringTypeW
HeapReAlloc
LCMapStringW
FindFirstFileExA
oleaut32
SysAllocString
SysFreeString
VariantClear
gdiplus
GdipCloneImage
GdipFree
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipAlloc
Name
.text
Size
282KB
Virtual Size
281KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
57KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=241, version=40116,
count=139, id=243, version=40116,
count=13, id=242, version=40116,
count=2, id=253, version=31616,
count=18, id=260, version=31616,
count=10, id=259, version=31616,
count=57, id=261, version=31616,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=135, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=291, id=1, productName=Unmarked objects,
count=50, id=261, version=31630,
count=1, id=256, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,