matcha.rar
- SHA256 6e85c5dee53761d3ff45f57ab4b87425137c0f764d3653f5a2e91c7abb01a5ac
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
matcha/loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
matcha/loader.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target matcha.rar
- Size 12.0MB
- Sample260709-thv2hady6x
- SHA256 6e85c5dee53761d3ff45f57ab4b87425137c0f764d3653f5a2e91c7abb01a5ac
- MD5 4b46b5c432e189828de712e93ce65019
- SHA1 35257fcb1b177d7e818b784774218b35bf400c73
- SHA512 87f0d4024743267a263941d7a3a6886a75bddd51acea6e6fdb14d5d29659fa1b3757a1dcd60dec00e114b33c29cf280effffac0a1069c679cce9bf963f898ee5
- SSDEEP 196608:ovjxEylTiuk+TmyLlexF8CnxwzYItvW97+AyIsPlY2OyLF1IbVy+Yon4+U1jKkCr:mlEMiukGL8xlnGzN54i/9Y0F1IR+vx1c
- TLSH T1EFC6330A1DEB305B6AAD7E127BA3098E2E927054FF767147122D21D71244AFDCC1CA7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/matcha/loader.exe
File Explorer
-
matcha.rar.rar 12.0MB
-
matcha/loader.exe.exe 14.2MB
matcha/loader.exe
- IMPHASH db06c467dce77a6c99fdd8865db066bf
- SHA256 3ad44d0b739b43078efc8a7f794e58a4a27a54cb59b2bdd825fb831e9b40940b
- MD5 2c8bd22c986588212276324a75eedfa4
- SHA1 7c82ec48b98585e82c6ab0fbac0620de9ded5465
- SHA512 71e934f87122fed2dba93c217721c0de33ba0abcc412764b9db4cf49226d52bfa3c48b81fb5334ae867405cd17e2711cc872cc5a3fbb494872d68d66d5c2b241
- SSDEEP 393216:DkrteQPxAa2hPZ354oMDkQ5YYK3K4zOIOp:Dkn6P154PbYfa0OI8
- TLSH T1A2E6128569D0D6BCC8848238F24516F9F4C93C8D8DF9952ABFC758217A31D98C8B67B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
22853103
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
FreeLibrary
user32
EmptyClipboard
advapi32
ConvertSidToStringSidW
shell32
ShellExecuteW
imm32
ImmReleaseContext
dwmapi
DwmSetWindowAttribute
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
userenv
UnloadUserProfile
wininet
InternetOpenA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Name
.text
Size
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
. Pb
Size
Virtual Size
8.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.Ml9
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.;gX
Size
14.2MB
Virtual Size
14.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ