15072026_0315_Bonifico n.1101252230290313.exe.iso
- SHA256 fe6a7db6a680805ff319a6ff8e19ea4b6c9e42623887162c53bc8f7a2dea942c
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bonifico n.1101252230290313.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
Bonifico n.1101252230290313.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
300 seconds
General
- Target 15072026_0315_Bonifico n.1101252230290313.exe.iso
- Size 2.0MB
- Sample260715-dr286sdv9x
- SHA256 fe6a7db6a680805ff319a6ff8e19ea4b6c9e42623887162c53bc8f7a2dea942c
- MD5 30baa39bbd0d1ad26b871e9fee44d4a9
- SHA1 330c1447a047bc6a92bd2fe05937ef6b9efc628c
- SHA512 84f3070ac099ca5352ff5801e76a1b30bf583ad2000359cecfeb8d7dc512f02b3dcea6c594cfae369dbbe2202a32d331131e30f44e9146724887eedc48088d03
- SSDEEP 49152:DS9ZGKd9rfG8GcW2wdgVnAp6nZSrWu5S3+q:KGMTFAUIr1IF
- TLSH T1B5A5C01DE39C12E9D227C134CBA66232E2B5B4560761B9DF369DD2152FB39D02F3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Bonifico n.1101252230290313.exe
File Explorer
-
15072026_0315_Bonifico n.1101252230290313.exe.iso.iso 2.0MB
-
out.iso.iso 2.0MB
-
Bonifico n.1101252230290313.exe.exe 1.5MB
out.iso
- SHA256 fe6a7db6a680805ff319a6ff8e19ea4b6c9e42623887162c53bc8f7a2dea942c
- MD5 30baa39bbd0d1ad26b871e9fee44d4a9
- SHA1 330c1447a047bc6a92bd2fe05937ef6b9efc628c
- SHA512 84f3070ac099ca5352ff5801e76a1b30bf583ad2000359cecfeb8d7dc512f02b3dcea6c594cfae369dbbe2202a32d331131e30f44e9146724887eedc48088d03
- SSDEEP 49152:DS9ZGKd9rfG8GcW2wdgVnAp6nZSrWu5S3+q:KGMTFAUIr1IF
- TLSH T1B5A5C01DE39C12E9D227C134CBA66232E2B5B4560761B9DF369DD2152FB39D02F3A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Bonifico n.1101252230290313.exe
- IMPHASH f765367f0a88e2dcf14edcaad7ab658b
- SHA256 7550b52651ebd31c33a77f798b07c7365827ca759adfe8092de83683b27ef198
- MD5 4553b0bc22871012fceedd02241449d2
- SHA1 786bf7010d1c06cfb20b2b8ec9dc4b091b6cc761
- SHA512 ee0800202d770586ce52e34df2d9264e585ce77166dd75da35c3d9c85ac41978f7ba7d2519ca106ad0770209d921d915ec2fe3da06e9981a6b8d43a5d8b58143
- SSDEEP 24576:FS9jVBUaZP732a4Cd9rfG8GcbGz2wdgVlNVZnApYfnOVUFJ8rMG6VOtUC4UPSOKD:FS9ZGKd9rfG8GcW2wdgVnAp6nZSrWu5U
- TLSH T12E75C01DE3CC12E9D227C134CBA66232E3B5B4560761BADF1699D2152FB39D02F7A312
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
686016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
RegisterEventSourceW
ReportEventW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
bcrypt
BCryptGenRandom
kernel32
InitializeCriticalSectionEx
EncodePointer
CloseHandle
CreateEventExW
DuplicateHandle
FormatMessageW
FreeLibrary
GetCPInfo
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessorNumberEx
GetCurrentThread
GetEnvironmentVariableW
GetLastError
GetModuleFileNameW
GetProcAddress
GetStdHandle
GetThreadPriority
GetTickCount64
LoadLibraryExW
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseFailFastException
SetEvent
SetLastError
SetThreadErrorMode
Sleep
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WideCharToMultiByte
WriteFile
RaiseException
AddVectoredExceptionHandler
GetModuleHandleW
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
FlsAlloc
FlsGetValue
FlsSetValue
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetCurrentProcessId
SwitchToThread
CreateThread
GetCurrentThreadId
SetThreadPriority
SuspendThread
ResumeThread
FlushProcessWriteBuffers
GetThreadContext
SetThreadContext
GetSystemTimeAsFileTime
CreateMemoryResourceNotification
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
LocateXStateFeature
SetXStateFeaturesMask
VirtualQuery
DebugBreak
WaitForSingleObject
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
IsDebuggerPresent
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FlsFree
RtlPcToFileHeader
RtlUnwindEx
SetUnhandledExceptionFilter
InitializeSListHead
ole32
CoUninitialize
CoWaitForMultipleHandles
CoGetApartmentType
CoInitializeEx
api-ms-win-crt-heap-l1-1-0
malloc
calloc
_set_new_mode
_callnewh
free
api-ms-win-crt-math-l1-1-0
log
__setusermatherr
api-ms-win-crt-string-l1-1-0
strcpy_s
_stricmp
strlen
strcpy
strcmp
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vsnprintf_s
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_crt_atexit
terminate
abort
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_register_onexit_function
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
686KB
Virtual Size
685KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
44KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.gfx
Size
565KB
Virtual Size
565KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=35403,
count=13, id=260, version=35403,
count=47, id=261, version=35403,
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=165, id=1, productName=Unmarked objects,
count=8, id=259, version=35225,
count=5, id=260, version=35225,
count=1, productName=Unmarked objects (old),
count=61, id=261, version=35225,
count=1, id=256, version=35725,
count=1, id=258, version=35725,