d.rar
- SHA256 0f4367f2b69ed6c27d19ee6a5166a3ec8394bca04e55e9399a64825d717e1d3f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d.rar
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
d/d.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
d/d.txt
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
d/daws.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
d/daws.txt
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
d/rushwoofer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
d/rushwoofer.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target d.rar
- Size 210KB
- Sample260709-p35dfsay2m
- SHA256 0f4367f2b69ed6c27d19ee6a5166a3ec8394bca04e55e9399a64825d717e1d3f
- MD5 c11362027b00a43c57374c7701b0e74f
- SHA1 466710b250d3ea914974905ed6c56a6eb241af9d
- SHA512 ba1625739b65cad8fd622ccec064bdad98b088a7d5355b1c1464c5b3a21a179c4d9f9d7b91c24511829b00e05c0f0f826abcefcdc52db888840e52a2a0ab5fd5
- SSDEEP 6144:dGRjMMhVaEEhQSSNxuDC8u8Hdc8YUSQ4kR:c9hXhEhQLh8V9c87H4o
- TLSH T18C2413DF88F10A8D8FF5EE52D455792A07401EB1737AC5CBE61139983F9580BE12685C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d/rushwoofer.exe
File Explorer
-
d.rar.rar 210KB
-
d/d.txt37B
-
d/daws.txt19B
-
d/rushwoofer.exe.exe 705KB
d/d.txt
- SHA256 38da91a46cde85e22d56135e4884095f158aa02dc01797910bdaa9f69ce73e4e
- MD5 d4cf3793055920884d6088d6cb104dbf
- SHA1 f299f62b855d643894575a29278c6d9e6ee82ac1
- SHA512 b6ef30bc961e844085c686da122486e31b7a1586dba4b7855ab39bfc9008914336b3d699dc698b62a79d3cdc8f6d2fa95ca1608270a2bc977c758647f9862a8f
- MD5 SHA1 SHA512
d/daws.txt
- SHA256 c248e6cc0f1b868e1759fe3421bd97f86f29cf53606dd5f7e957f67d944d0341
- MD5 1a46d8c41792d99a3db112d099e08bed
- SHA1 93a0fcc059dcc66f97dbbea9a9330d574737b7f3
- SHA512 4abd36b49eb405be4fecb120c3eb22d66037e8fc3318809f5414467a7d320c0abfb580d55727342cb672a72cda0d9bc215b81913e161a16e0750888ae7e83d6d
- MD5 SHA1 SHA512
d/rushwoofer.exe
- IMPHASH 21134cac140b0cd70fef9f9bd4e13eb0
- SHA256 4134cc9bb99e0fceeb02f9e074b1f7fdbba76d1aeec9f76d80e1b12016721b5f
- MD5 1689a4c010dbcd446f45799b9736d48d
- SHA1 505d3a5a15c99b0e35f57b194aa4da3a0dda83ee
- SHA512 4639c446ac3bed1b76e6b15136d73556623b0f28ffa45b5717a68c1ee6acd929d7f5ac39679863eef56f84d093a373bbc70a464d9cc678b6d25e220773994dd9
- SSDEEP 12288:OyU7vs4Fsi1eF6HFi+LuBua81amQI4bsXU75A9l9+oIDRc5F+ha:OyU7vs4Fsi1eF6HFi+LuBua83QI4bsXS
- TLSH T1B6E47CE9972C05F9E662C23C89566606F6F2BC5E03A0DFFB33D04EA51E1B5C4DA39640
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
381856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
MessageBoxA
GetCursorPos
kernel32
SetCurrentConsoleFontEx
GetModuleHandleA
CreateToolhelp32Snapshot
Sleep
GetConsoleMode
GetLastError
GetFileAttributesA
SetConsoleCursorInfo
Process32NextW
GetCurrentThread
Process32FirstW
CloseHandle
K32GetModuleInformation
SetFileAttributesA
GetThreadContext
GetConsoleCursorInfo
GlobalMemoryStatusEx
WideCharToMultiByte
SetConsoleOutputCP
SetConsoleCursorPosition
VirtualQuery
IsDebuggerPresent
VirtualFree
VirtualAlloc
GetCurrentThreadId
GetCurrentProcessId
DeviceIoControl
CreateFileW
GetModuleFileNameW
GetTempPathW
HeapSize
SetConsoleMode
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetModuleFileNameA
WriteConsoleW
SetEndOfFile
GetProcAddress
MultiByteToWideChar
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
ReadFile
CreatePipe
GetExitCodeProcess
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
CreateFile2
AreFileApisANSI
GetModuleHandleW
MoveFileExW
GetFileInformationByHandleEx
RtlUnwind
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
SetUnhandledExceptionFilter
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetConsoleCP
DuplicateHandle
CreateProcessW
DeleteFileW
IsProcessorFeaturePresent
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
WriteFile
GetCommandLineA
GetCommandLineW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
HeapFree
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleOutputCP
GetNumberOfConsoleInputEvents
ReadConsoleInputW
PeekConsoleInputA
ReadConsoleW
WaitForSingleObject
advapi32
RegSetKeyValueW
RegDeleteTreeW
RegCreateKeyW
RegOpenKeyW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
wininet
HttpOpenRequestA
InternetOpenUrlA
InternetOpenA
InternetReadFile
InternetConnectA
HttpSendRequestA
InternetCloseHandle
ntdll
NtQuerySystemInformation
NtUnloadDriver
NtLoadDriver
RtlInitUnicodeString
RtlAdjustPrivilege
Name
.text
Size
544KB
Virtual Size
544KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
134KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=198, id=261, version=33145,
count=17, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=18, id=260, version=35721,
count=91, id=261, version=35721,
count=11, id=257, version=33145,
count=185, id=1, productName=Unmarked objects,
count=8, id=265, version=36248,
count=1, id=258, version=36248,