winzip11.zip.7z
- SHA256 1a947d0bfe30bbd2363d5467a29d0af8d515ece7e8c74155a5db16edee2cf754
Password
infected
Behavioral task
behavioral1
Sample
winzip11.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target winzip11.zip.7z
- Size 5.6MB
- Sample260710-12jadaew4x
- SHA256 1a947d0bfe30bbd2363d5467a29d0af8d515ece7e8c74155a5db16edee2cf754
- MD5 2f5d22f3ca11787008f8731b6545a941
- SHA1 afda8cd77cb432c3264535044f4e8297ffa65658
- SHA512 3e7ab61ba3d01c376a6fc3d6119dff6c720087c506c82a85eef565b560ad76c7a1f0eac26d2bf0e7c9bbca1d1066774ac86077e26ac8de25d7ba243e33338c99
- SSDEEP 98304:JeEWeyFtqZ4F3hdzRlLFYHQfkBc32tAmaoLfgmhHoUkkn1S1BtDXkmqj/PqsZ4ke:JBgFtqZm3XRBuQf132tA+frIUk9F8/Ce
- TLSH T1464633C23EC52A4E48CD397A29652AFD0336AF1F6C37E0851AC4F57FB529807786291D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack002/winzip11.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/winzip11.exe unpack003/out.upx
File Explorer
-
winzip11.zip.7z.7z 5.6MB
-
winzip11.zip.zip 5.6MB
-
winzip11.exe.exe 5.6MB
-
out.upx.exe 380KB
winzip11.zip
- SHA256 a3ae7001bc858095e724d5eb863c7e617e7ef287644f8fda44be29f61d5ac116
- MD5 f94f3dbd0eb478c9116f8ebfb8b24750
- SHA1 563e934c6a3753a3b800d091eb79f096158b9d13
- SHA512 c67d58f78517f7285569a717fb25c5817f7909773a132422f99fb3c5537785d4e0af9d18304d36ef4f98de9d54ddf8096afadbe57cbf1c9ca24d3bae2a4e3240
- SSDEEP 98304:6ktsDH9xdvbExHa5Aj8nuzlDREtlHHr0xyImvJJO3NMyy1TDe/eHiytZUVXTFpM:btsDdjYxH1FzVREPnr0tSJ+N8FHUFpM
- TLSH T1B446338294D5FA40BB64B041BA72DE24237CCCF6D9293D934B3D450579FB16E20E93AB
- MD5 SHA1 SHA512 SSDEEP TLSH
winzip11.exe
- SHA256 7cf4c2cd94cf6eb9dd0fe65fbea08d8e8d62385b33b02af6cb2e14ecae6656d9
- MD5 4bf2bbe05bcd27eb014def7494fc0868
- SHA1 41b53cdeb136b1cfc7a4f8466e7532ff0b007a18
- SHA512 c5f40313cf7376054ba5e4be5fb771b4f7b9f35a372423d7483865fe82ed1dac921a2eaf7ec1fce08dea630bb77f3e65a0202157660f56409b92e500c9bb8e1e
- SSDEEP 98304:4HHX3vBSRH8nIp8NuJvbDMtzzHJ0lY+m7hVOJz6koHxD0bezY05Z8VXFjpx:4nHQRHZ3JjDMtzJ0ngVuzmpzojpx
- TLSH T12346338390E4BE40EA207032B572DE242238CCB7992D3D535F7C591B7DFB25825A56AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
493008
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
308KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
170KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=4, id=105, version=2067,
count=12, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=38, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=152, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=4, id=25, version=9210,
count=21, id=93, version=2179,
count=436, id=1, productName=Unmarked objects,
count=54, id=100, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
out.upx
- SHA256 8929853aa94d51a0535ecbdf57d01c9f3216a04a8f511c01298f045142e440d4
- MD5 9ca4f0100a9ac8fadf60219014b336bd
- SHA1 9af22a342d5a122c5f0af90f506d5c1db5193583
- SHA512 f9cee47ee2739997f566a98db0431fcad949f8935e78f799d2408e0b365cdad67a34e158b5533779e06ea578956eba70914633bcfa8c3a27538ecf9ab05a7f39
- SSDEEP 6144:NvZ2iKiZ/QAKVfiROzkViZwc0W/1vNuMqTp/CelAaWjSZ/n+nKCXr:N7wVfiRuqPW/dgMqIHdjSF+nKCX
- TLSH T126849D337AC1C075D15214B15E65E732B668FA7089329E43BBE41EDC6B728C1A73AB07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
271076
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
313KB
Virtual Size
312KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=105, version=2067,
count=12, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=38, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=152, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=4, id=25, version=9210,
count=21, id=93, version=2179,
count=436, id=1, productName=Unmarked objects,
count=54, id=100, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,