vortex.zip
- SHA256 32d5831f16e34b20896165f384237a8aa1e0a868a1c02c8350b00757564e760e
Behavioral task
behavioral1
Sample
vortex.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
vortex.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
vortex.zip
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vortex/Bootstrapper.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
22 signatures
150 seconds
Behavioral task
behavioral5
Sample
Vortex/Bootstrapper.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
150 seconds
Behavioral task
behavioral6
Sample
Vortex/Bootstrapper.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target vortex.zip
- Size 3.5MB
- Sample260706-nsrh6set4z
- SHA256 32d5831f16e34b20896165f384237a8aa1e0a868a1c02c8350b00757564e760e
- MD5 e8c6ee48e63fc826f8c9d8248870f4ed
- SHA1 0995055ccec0262469a94b0cb412f4153ed0c2ea
- SHA512 c124c2351b099af8d45e51b47679d515ddca3f0e7f4d878e3347ed6c72cb289aa3734b5f4d74ed67568f21727e4953f5a4448884504039936a49c98fd1589e6d
- SSDEEP 98304:m7tgSkozBuxaqGp6iK+dkCJ5axKRDFRX/M3BAXHG:OgS7qolfEaXHG
- TLSH T11606339CA79F7508FBEC668AE3C160C2776B770E4640DC590C3586B718827EB3676643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Vortex/Bootstrapper.exe themida - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vortex/Bootstrapper.exe
File Explorer
-
vortex.zip.zip 3.5MB
-
Vortex/Bootstrapper.exe.exe 3.5MB
Vortex/Bootstrapper.exe
- SHA256 a958590ad4a3505caf86fa8f473dc4ff11081d8b03b0cf850efece9e00a9dd96
- MD5 a5b2b44bee8533b903877fbf5538f3d6
- SHA1 b8d1b2c836358215fdd0da611e042de1dde11751
- SHA512 5eea50aec1b09a542ed611e39e8425ff78de92d47962438ad7ec9649ae5d650d4bb663107d6d1b2de73196ec2667072f4ed98cdefb5a94f2086dc3255237ebe0
- SSDEEP 98304:q1ojI+B7crZMj0IBP4WNiKvhMGIYqopMfcf9ho:rMSmqjbP4HKvMxcf
- TLSH T1C50633D6CBC25E55C3FE637309BAA98F4EC9565EC658464CA81948EF02431F0DE17F0A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6295640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
108KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
31KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
6KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=174, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=85, id=261, version=35207,
count=9, id=257, version=33145,
count=119, id=1, productName=Unmarked objects,
count=1, id=265, version=35226,
count=1, id=255, version=35226,
count=1, id=258, version=35226,