Joemama.zip
- SHA256 c04c816272a0d0da3ca44d338c008e3e5fb8e09776545747610a1121493e328e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Joemama.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
600 seconds
Behavioral task
behavioral2
Sample
Joemama.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
General
- Target Joemama.zip
- Size 214.5MB
- Sample260714-kd3fcaby31
- SHA256 c04c816272a0d0da3ca44d338c008e3e5fb8e09776545747610a1121493e328e
- MD5 0bfb2d2c9de0ccca2a40d2a071e30374
- SHA1 3c79b5efad4faf53c3d4ca1f6ed6faf262c631db
- SHA512 ee08ef41e40c433385c221cc75e8aecdb8e6b1566b53e6fdaaa537a40e8a00154f8fd853f9e72fe3f50f50632793791cd878cfdacbe5839b7828b4e7388180c8
- SSDEEP 6291456:I2VkXHGn1Mv4WTMvtfvnj2+GP159XxZDglrtuS8:Bimmv4W81RE1fxZDG/8
- TLSH T12BB8338426761D54EF582BBAE3D9271CB0C8435DE234D8E1B65ED0C467A33C14BBB62E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Launcher.exe
File Explorer
-
Joemama.zip.zip 214.5MB
-
Launcher.exe.exe 12.1MB
-
dotnet-sdk-10.0.301-win-x64.exe.exe 203.1MB
Launcher.exe
- IMPHASH 53e4e12437621212a425d294842d0a96
- SHA256 a7e3b5a7ade3143b3428028bcd43641d824e4803b68f9e2f3b16565a8c4f2d8a
- MD5 d205d061ca42473600a373ffc0139a42
- SHA1 8159c7143075484edf4d670950dd81928a67cc00
- SHA512 246b4e3291c079f17e0557d5cd2ee95692e944e46660d2fa8603ed3a42970ca460a10281de21941e5098c0e370648bc9cee7c259b2ff616f0838f5253ed47c95
- SSDEEP 196608:ZmCS6G1g7nwbLrNxuHHW91t09t/LTgpVorqw85AjU34/POe9:MCxGG7wXBxuHHq8X/LTgPlRAsGOe9
- TLSH T17FD6331A4DA806D2F1EA82BDC9121650F77278B74B7093DB1B50D41A2F233EC9D7A763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80800
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
exit
_initterm_e
_errno
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
abort
_invoke_watson
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
_callnewh
free
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
wcsftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
__p__commode
fputwc
__acrt_iob_func
__stdio_common_vswprintf
_set_fmode
_wfsopen
fflush
setvbuf
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
_create_locale
___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_configthreadlocale
setlocale
_lock_locales
_free_locale
_unlock_locales
api-ms-win-crt-string-l1-1-0
strlen
strcmp
wcsncmp
toupper
strcpy_s
_wcsdup
wcsnlen
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
dotnet-sdk-10.0.301-win-x64.exe
- IMPHASH 5151357172be63bb3c9c00e45447ca55
- SHA256 6e7c6111f0978566d9a10b8846bedac8385a22a234f86325b621decb9f25b235
- MD5 9b7f82db87024a1200897498a3ef92b5
- SHA1 54bbd19be15530a76c8dcd61ca7e86df30baa9f0
- SHA512 96b7793f0d1f40d8a8a05f9f076d6f4146045429ae2ca17906f109d8747ac34826d9775ffbd0afd9b01bc84bac1a3dba02a6d86af08fe2809276c3e3ffa49098
- SSDEEP 6291456:oCuw53828EEANiz6OhCrloVKdYXZ6rAIoR2b8:oEO2kANizUqod8Z6rI7
- TLSH T177A83371655A0C26EFF80B73F18662387E6C8708A77484E6E1C4D84D36A63D59FB720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
dc:ac:2d:4a:0f:f9:d8:82:0d:58:a9:c2:15:ab:bf:a1:23:9d:a7:57:aa:d5:63:20:c4:b4:5e:0c:62:0d:1c:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 21, 2026
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:c7:9a:a1:ee:dc:27:e2:f8:b7:00:00:00:00:01:c7
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
337888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB paths
D:\a\_work\1\s\build\burn\Release\x86\burn.pdb
kernel32
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseMutex
CreateEventW
GetCurrentProcess
CreateThread
GetNativeSystemInfo
VerSetConditionMask
GetSystemTime
GetComputerNameW
VerifyVersionInfoW
GetDateFormatW
CompareStringW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetSystemDefaultLangID
GetStringTypeW
CreateProcessW
DuplicateHandle
GetExitCodeProcess
CompareStringOrdinal
ProcessIdToSessionId
OpenProcess
GetProcessId
SetProcessShutdownParameters
CreateSemaphoreW
LocalFileTimeToFileTime
GetExitCodeThread
DosDateTimeToFileTime
CompareStringA
SetThreadExecutionState
ReleaseSemaphore
CreateMutexW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
FreeLibrary
TlsSetValue
TlsFree
EncodePointer
GetStdHandle
GetModuleHandleExW
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
DecodePointer
WriteConsoleW
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
ExpandEnvironmentStringsW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetModuleFileNameW
GetSystemWow64DirectoryW
GetSystemDirectoryW
GetLocalTime
SetLastError
GetTempPathW
GetVolumePathNameW
GetTempFileNameW
GetFullPathNameW
CopyFileW
GlobalFree
GlobalAlloc
Sleep
SetFileTime
SetFilePointerEx
SetEndOfFile
ReadFile
LoadLibraryExA
GetFileSizeEx
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
FormatMessageW
LocalFree
MoveFileExW
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
WaitForMultipleObjects
WaitForSingleObject
HeapSetInformation
GetLastError
lstrlenA
GetCurrentProcessId
GetModuleHandleA
MulDiv
GetSystemWindowsDirectoryW
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
LoadResource
LockResource
SizeofResource
FindResourceExA
VirtualAlloc
VirtualFree
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
WriteFile
SetFilePointer
CreateFileA
ExitProcess
CloseHandle
TlsGetValue
CreateFileW
user32
GetDC
ReleaseDC
MonitorFromPoint
MonitorFromWindow
ShowWindow
IsDialogMessageW
LoadCursorW
GetMonitorInfoW
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
SetWindowPos
CreateWindowExW
UnregisterClassW
RegisterClassW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
WaitForInputIdle
IsWindow
PostMessageW
LoadBitmapW
gdi32
DeleteObject
SelectObject
StretchBlt
GetObjectW
DeleteDC
CreateDCW
CreateCompatibleDC
GetDeviceCaps
advapi32
GetUserNameW
CryptAcquireContextW
CryptReleaseContext
QueryServiceConfigW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
OpenProcessToken
AllocateAndInitializeSid
CheckTokenMembership
GetTokenInformation
AdjustTokenPrivileges
IsWellKnownSid
LookupPrivilegeValueW
RegCreateKeyExW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
ControlService
CloseServiceHandle
ChangeServiceConfigW
SetEntriesInAclW
DecryptFileW
InitializeAcl
CreateWellKnownSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
ReportEventW
OpenEventLogW
CloseEventLog
RegQueryInfoKeyW
RegDeleteValueW
RegQueryValueExW
InitiateSystemShutdownExW
RegOpenKeyExW
RegCloseKey
SetNamedSecurityInfoW
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetEntriesInAclA
ole32
CoInitializeEx
CoInitialize
CoInitializeSecurity
CoUninitialize
CLSIDFromProgID
CoTaskMemFree
StringFromGUID2
CoCreateInstance
oleaut32
SysFreeString
VariantInit
SysAllocString
VariantClear
shell32
ShellExecuteExW
CommandLineToArgvW
SHGetFolderPathW
Name
.text
Size
481KB
Virtual Size
480KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
232KB
Virtual Size
231KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
212B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wixburn
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33140,
count=146, id=261, version=33140,
count=21, id=259, version=35207,
count=19, id=260, version=35207,
count=44, id=261, version=35207,
count=20, id=260, version=33140,
count=2, id=262, version=33140,
count=15, id=257, version=33140,
count=355, id=1, productName=Unmarked objects,
count=89, id=261, version=35215,
count=1, id=255, version=35215,
count=3, id=151,
count=1, id=258, version=35215,