triaga.rar
- SHA256 b2caa30b8e1a253111718d4fa0189df146e2d2e6e6b966afa260aa81f4e34192
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
run.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
run.ps1
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target triaga.rar
- Size 1.9MB
- Sample260706-27rdlsav2m
- SHA256 b2caa30b8e1a253111718d4fa0189df146e2d2e6e6b966afa260aa81f4e34192
- MD5 e99f2e3a1577ca34ee2322b58332a437
- SHA1 7f23310d49d37a6104f605f81c572a77ed43e406
- SHA512 bff4da0e3aa6ebd04e4a09c57d47e0834b7bb318664f6099542f0601a19b65e4e20b980653c87e3808acb4b7dedd6a25933a2bf42113ad9277b35e6f783ec28e
- SSDEEP 49152:u00dkLYNrRFcLGogA+u/jdnhR+Geqn8ACZMOf0qWRwrS4Yg5py:Akks0uLdnPNn8A/bqrrz+
- TLSH T1AC953383E696197BB153B9CFD4E2CECB7361863CEC7F529792854762B293C03DA96004
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fuckvac.dll
File Explorer
-
triaga.rar.rar 1.9MB
-
fuckvac.dll.dll 2.1MB
-
run.ps1.ps1 326B
fuckvac.dll
- IMPHASH 7b43ed892119923fba3d6b4febcda4f1
- SHA256 af02612545e4f84920bad38b9fe5ec6c60d6bce656931afe215e42821eb6d319
- MD5 466be4079e228e25f9d443df728cc0b7
- SHA1 16ca585ddbe423d85fcfcb0e147ea3530e91d4f0
- SHA512 15272ffde44d6432f498d36199ebb2b6a8f93b62ce66822728a97cebc2056f5ef1562672b780f95e00c86a02b39e1eb8acd565777a3ffdbc76da7968432c751b
- SSDEEP 49152:46Vle7nD0RXAv/JedzLrDx5YKcNDAtjIEx6WdIny0V++:rCURSxedXodNkfx6WEi+
- TLSH T115A52255F9D29B78C5F2823417C341B0B08B24144CAA9FABF6FA9A017C72C9E624775F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4118233
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntdll
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
RtlVirtualUnwind
NtProtectVirtualMemory
NtAllocateVirtualMemory
RtlLookupFunctionEntry
RtlUnwind
kernel32
AreFileApisANSI
GetEnvironmentStringsW
HeapSize
VirtualFree
GetCurrentProcess
GetSystemInfo
VirtualQuery
HeapCreate
HeapFree
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
SetConsoleTextAttribute
GetStdHandle
SetConsoleTitleA
AttachConsole
FreeConsole
GetConsoleWindow
AllocConsole
FindClose
FindNextFileW
GetLastError
SetLastError
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetEndOfFile
SetStdHandle
GetProcessHeap
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
FormatMessageA
GetLocaleInfoEx
FindFirstFileExW
LCMapStringW
QueryPerformanceFrequency
InitOnceBeginInitialize
InitOnceComplete
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
InterlockedFlushSList
RaiseException
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateFileW
ReadFile
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleOutputCP
ExitProcess
FreeLibrary
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
VirtualProtect
LoadLibraryExW
FreeEnvironmentStringsW
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
PostMessageW
ole32
CoTaskMemFree
Name
.text
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
382KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.#I5
Size
Virtual Size
636KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.=ly
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.#?n
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
84B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
run.ps1
- SHA256 37bae69d64485614e98d322daba3f53955d55e64842a5533b7bee119af3699a6
- MD5 61dad0c680fe5cc716ecdbb91f0fca1e
- SHA1 f995112bdc2f4a405c6cb7d177fdf7836c72e9c2
- SHA512 684de4fe75d09f18bd847d26907a691562170d80e2e17fe38af7d34784ee3dc21954cad705f411dd70de38ef949d7923e4c610a426b515bfb99321c844f72d95
- TLSH T17DE086234C531AB7C5F04A25C8505BADDD57443A5F4784B069FB8CC970B13188595176
- MD5 SHA1 SHA512 TLSH