cooper.zip
- SHA256 317ad081ed3ad5b85035a52ffae3e759b216fc66593050fdd61ad409c54e0aa6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Aphrodite Cooper Movement.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Aphrodite Cooper Movement.txt
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
TGMacro.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
TGMacro.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
libs/CSInputs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
libs/CSInputs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target cooper.zip
- Size 292KB
- Sample260712-1ppavsbt4v
- SHA256 317ad081ed3ad5b85035a52ffae3e759b216fc66593050fdd61ad409c54e0aa6
- MD5 a27c73e7ce4f3ed9eb490df972a17469
- SHA1 e072972860ffe48ca7b14b52848905dbae1942c6
- SHA512 f2e0baa2303f1f4381379b4540a8193999b0bd9f0ba653f64a2b451876bf6d1e189aea688d11adee0bacfebe9e3af55d9299c63a3a5d620b995fb636fe3df5d0
- SSDEEP 6144:wf5eDMxPPYLH0Z5MMK4lq/N27+gJv53C+x/iuC4FYwbYmmnhGVuMN8Ycc:w0DkQHE5MMK0cs7bVjDnGGVuY8m
- TLSH T1B15423C864A07B44943BBA747AAA4AC576A6ECD37BE44D64741FCC46F07E0A6305F8F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/TGMacro.exe unpack001/libs/CSInputs.dll
File Explorer
-
cooper.zip.zip 292KB
-
Aphrodite Cooper Movement.txt1KB
-
TGMacro.exe.exe 1.1MB
-
libs/CSInputs.dll.dll 19KB
Aphrodite Cooper Movement.txt
- SHA256 adfd193c2f7b4ec60b88623fc973004a75c9b155fb9dc29229ed61107aaeda31
- MD5 dbb37ef335924327a73b7252de7be08e
- SHA1 4218d831b691f74cb3d614436aaebd73ffe091a4
- SHA512 97dd32177ac3e36bc2231bf5061237ff146205b9a24d031c4c801c2864c2d41c1ee8486ca3193b0a81116ef3538162eb7afd8e0e9b82028197ef6401ed7b43e5
- TLSH T10431014F7242463226571363488AF5D7D71B913A7657A474AC2E81CCD329F2092B73BD
- MD5 SHA1 SHA512 TLSH
TGMacro.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 53e4f3aea0b20ca47fbdb6b06359e0744cdfa23909a0a9eaf1699203e12b8374
- MD5 121f7b67d1d2b8dadcbb762bf671b385
- SHA1 e70ca9efaf2dc8d1b50919c0e2e2d7e18cc4322a
- SHA512 c3ffd0183a773c86cee00f690a78e80c673243fff364cbbf0c4bf5b1e710439128446d1951b3ce2d83a0d4bfff5808102ca627f638e151ae719967e6b3b00885
- SSDEEP 6144:prc+YhMnjN9vQG/nwoPmF7k5hymFEymFEymFEymFEymFTymF8ymFYRM3GWONymK0:q+QGN9vQG/HETssssjajRM3BOco
- TLSH T14F3528D1195C0BD6F9F423F27C9B15567B38B154D19AFA89BEFA20CD5801BAA0A03F13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1053738
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\tarik.saylan\source\repos\trksyln\TGMacroPRV\TGMacro\obj\Release\TGMacro.pdb
mscoree
_CorExeMain
Name
.text
Size
1021KB
Virtual Size
1021KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
113KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
libs/CSInputs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa2b174fe652cec41746abec094ac9875563cb271b2828258c829f95452d4d6a
- MD5 f5e000d854b7a4c0ce4258b8118a6174
- SHA1 3034b964b47dc6122623fe245299d1e99b779325
- SHA512 99a7b9baeaa592766942611dae7f5792daba059a704c4ad9b1f4833266aaab773676f374b626f978c77cf14c03a9dc38093cf5e7c3c087aabf7211e8df43105a
- SSDEEP 384:uh5Z1jCykagUUUZ0Rh3OLcXD81cuw1icVqJGjDXA7yYYKhpbMKL/j0Q2B:+1jCE/UPh3OenT4qDXvej0Qi
- TLSH T1A2922A265398C730C4A90F7DA4E202610778F0406742FF6ACADCE5AAAD97F694691FD3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\tarik.saylan\source\repos\trksyln\TGMacroPRV\CSInputs\obj\Debug\CSInputs.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ