ALrH2bBByHH.rar
- SHA256 a8cfeb1cb3cf0278093fb09d79453c77d8ffd51617a638e7b52f4271bb66d388
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ALrH2bBByHH.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
ALrH2bBByHH.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target ALrH2bBByHH.rar
- Size 3.8MB
- Sample260714-ph8kdaev8s
- SHA256 a8cfeb1cb3cf0278093fb09d79453c77d8ffd51617a638e7b52f4271bb66d388
- MD5 5f5fd124443d36c70429398637659a99
- SHA1 0f9fa642d1363ab0d35d22b80d7477239289ccc3
- SHA512 21c87561b6d6f8b56a5d5c01420dae3bad4d6003bb1bad3ef70937ffadf911343856b63a4b686de03e8ddffabbdcbdbab0d0eb59eb8fd256e6b2234830555054
- SSDEEP 98304:7Cbf+O6uRzii662Qd7uYTIMht5xLwksUMAKe8Ravfbcx4Xm:7EfKKzii6907uYTIMht5hwksUM5HR+fu
- TLSH T105063310970C1F7AC87A6352CC52A5224707229C9B4AE8B794EBFDDD5B15FB824B7B0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/Commandos.exe unpack001/HighHappy.exe unpack001/Knuckles.exe unpack001/PEEKABOO.COM unpack001/Smil.exe unpack001/Squidward.exe unpack001/Virus/Virus NahSmi.exe unpack001/Virus/Virus.exe unpack001/Virus/virusH2keD.exe
File Explorer
-
ALrH2bBByHH.rar.rar 3.8MB
-
Commandos.exe.exe 79KB
-
HighHappy.exe.exe 82KB
-
Knuckles.exe.exe 289KB
-
PEEKABOO.COM.exe 921KB
-
Smil.exe.exe 365KB
-
Squidward.exe.exe 535KB
-
Virus/Virus NahSmi.exe.exe 1.3MB
-
Virus/Virus.exe.exe 921KB
-
Virus/virusH2keD.exe.exe 261KB
Commandos.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e0c0bb0b89ded0bcad1a4fbd9d7d989cacffe9c2dd963a89e86e13582cdf8262
- MD5 fe571936aa4654825c1c5df9cfe49227
- SHA1 c1ffe14039561511724621bf385ddc4c4291b156
- SHA512 646a1b1e5b02973df005c084d3a70f65a1f572563aa971b0247fbd4c1877ed7cd58d77c507e4f44bf7ac85f78b779b355025259cba9e5aec728aaf09a9dbec42
- SSDEEP 768:4Kxnvyx9lZYS8tu7Qi4eyulHCuytnY9QRcgQorIbjWqor2hCaK:1nqx975EQQi4LaHC1Y9QR/rIbjUP
- TLSH T1BD83E40235736D85C7BC25F706974AE443E5EC8106F189876A7BA60EFDEC6A84C47E83
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
HighHappy.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0f9617c86fd1a744a7185e1060b928cd05ddd63c70633dbe847d5582e60101fe
- MD5 788b0974f73acea93c7af807cbec1317
- SHA1 8a5482beb542396efef378d2556698ba4aebf363
- SHA512 487bab2035cef1a90f8c1f619af9b57784a4203b6291ef871db2340437f24184825ca931cb64f9fc58ebcc8b51e428f1261e8ff040cac2e919a285d00f8f1051
- SSDEEP 1536:KahfyS/+TAODerDpbuEpPEUwsbuUrVzBq05j9aJggFSoHdduVm0A9SBwwVcl:KahfyS/+TAODer9bFpPEobbxN5M2gFSM
- TLSH T1F283A1557394E65AC4231735D991D3F4A730DD85EA46C34B36E8BE2B3EBD2E28E412C0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\HighHappy\HighHappy\obj\Debug\HighHappy.pdb
mscoree
_CorExeMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Knuckles.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1f98a3f8852d28ed3b2f64e529c1ae1eafc5ef942a962ec89163f3db2744c8a4
- MD5 7e9d3109b138c0a67be983159fbbde98
- SHA1 012308407fada7ecb5edfe4e067fa4d18acba424
- SHA512 ac6a5a4ec87fe8770c1903f62d181f94366b2f9b3d3a4e8a04ec7f25b9e9d026762efc96ba5883474b9d1c2d0cca4a99e12f0343f6eac51af12d628a926a5e12
- SSDEEP 3072:Fxv5UYlnaArTD3FzIO4vphViwmtSEGsvXRUeMlyXxUpT1OXfqY:FxvaYlnaArvF8bzVi1SQPuluxWqq
- TLSH T1E5546B3A79788F95C60C0AB1BA61C1B3EB2F5D3D3481931F22DB77B9AEB5D4A1D01106
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
130478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\Freemasonry\Freemasonry\obj\Debug\Knuckles.pdb
mscoree
_CorExeMain
Name
.text
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PEEKABOO.COM
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
- MD5 d0ae6aea701de9f127f91e7efdb50252
- SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
- SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
- SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
- TLSH T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
948526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
918KB
Virtual Size
918KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Smil.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f534bb9d7cc4c0f8abf8adcc592a328a64a902211ab66bafd9a0c7a333e86a20
- MD5 ea210a16c2cd0f7d84d3961bccbfe73a
- SHA1 598a97e9c7aef20ccc65ed04aa9449564b53f48f
- SHA512 baad73a63e0e4c56bea3283f0072ff7682e37afa96403c99e714373ab49b20e990044f6a221a89d27fd8c763af06e7418886880d41cc557be9892daeb3877c65
- SSDEEP 6144:iT+DPxVn9PvkYyeryYpaVexc6dJ1QYsjHf6EnJrNlT9Fb+3jqSd6A5n6n9TCX+Ct:iT+rxV93k4HpaVexd/FuHfFLEjdnC9At
- TLSH T18A84135561BDF193EAF9917318FFA004961A972FA3056BAF1C84D937AF0AF84320791C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
235934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
222KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Squidward.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
- MD5 82bf26203c5d76dfa3a591f1cb60d7b5
- SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
- SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
- SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
- TLSH T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
305038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
244KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Virus/Virus NahSmi.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ae837e22582519086fa5634dc351ee0cf76df56b726dc2da507c9902c9baeaaa
- MD5 ca2be39dc5558518caaf96991533f684
- SHA1 0fca63b0f22b7c8f03a4f98797fd236f091e371b
- SHA512 a6656a28f2743574a28a04eb5cd27f74637af0ff9a47586b19c429083aba75b688ef9a61b7a1dacfe35007cc4b0f26cc114556b8c8e293035481ea321d8ffd0f
- SSDEEP 24576:C+s7Qs8rsEyRwfqcCgQijMFD1VtAxZqL5tMgK+LXMkgSLVe0t:Cn7QJpJglijG57CQDKEkSJe0
- TLSH T18255CD805384EE68E63663F0A535C47CA31BBE1498F0F92953D5FCA17A7AB7D98E1304
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1237838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
136KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Virus/Virus.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2cac45c4e575e1beb4e02a697e871414bdb34c04fea12e661df4f58551857d0d
- MD5 e422954444e066d0a408e5c248917173
- SHA1 e4549593133648dc652d3a8045cf4b639bb64b02
- SHA512 41c84678b0b6b4326fd8c6792a1f21d7263268a8ea14c8e365c70f14d31617df816ecf9c6e246750f2031f0c94df6dfca6d76046bf082a895c13e1c361412b2b
- SSDEEP 12288:8YqvlinBGlUAKNRTWIbbKTqihVAy6kI92YqgLPZrvi1Cz12G2bHuw9Z0qlh:xHGWAkTWZayk92YnbZrvbcG2uw70I
- TLSH T1FA151241E1888E72C5600F324076FE681267EDA525B4CB5E12BC7AF37F3768BED44686
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
810302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
783KB
Virtual Size
783KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
136KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Virus/virusH2keD.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fe62921266ea5ae5b1d2144360e1ced4bcb26e2bf76b07c1feec0c454a9ea532
- MD5 766d0050047300a4f3667d757dacc394
- SHA1 fc9eb5158e7e7632bf64e9e3da3db14c88f127fe
- SHA512 aa2b812501fa805858ca4b133cbd05b225164e2ef1e13b51b23bcafe22450d3d69a5d6cb2111cee09fad82d707fc84471c86c1530c258d08b191ddb2ed46cced
- SSDEEP 3072:V7YzL91iwAfBKvZE1wCn/4vCzEXCCT1JYNTOdPDxPWhjEG+j6GXD:0L91+fwvZOwy/RYXCE1UTED0+G+j
- TLSH T1D4444F1B232A8D86D2137ABE5954F38D025817E4796BC7E95832FC53FA40E4B5E3C8E4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
238KB
Virtual Size
237KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ