Release.rar
- SHA256 bc79adf17f0251e334915b0037326adb1c149b346d486f9fae6ab9691ce3c86e
Password
worm
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release.rar
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
900 seconds
General
- Target Release.rar
- Size 1.5MB
- Sample260718-3fm3jsfs4p
- SHA256 bc79adf17f0251e334915b0037326adb1c149b346d486f9fae6ab9691ce3c86e
- MD5 5a0a1b632af678651410bb062fb20415
- SHA1 b108eab3a8023d475d4be62506df26645d059c6e
- SHA512 37f98f242bcd6240fab4a8086f5aaab615b3e5f0726be30c5f12d4b1f8df46344e4bb8727b091f49b448208816b8166fbbef77ea3e3f51fc283e14758715bd46
- SSDEEP 24576:9SfJYtLXwn1zmVnalW/4g+Do7AqAsylPtRx04xtPfB47I0qpqUb1M97ADpTyQ7D1:9SfJeGc1DtNNy1NrF0qrbI8xyQ3wtUr
- TLSH T1DA7533CFF90D8CA85E2B5DC7E084D8A0AB091F966F98984C16F62E67B0F8D37541D934
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/skeetware.exe
File Explorer
-
Release.rar.rar 1.5MB
-
Release/skeetware.exe.exe 1.8MB
-
Release/skeetware.pdb2.7MB
Release/skeetware.exe
- IMPHASH e1c9fa402dfb21c9c2955f602b7d1835
- SHA256 39dc8d98a21a1364458f84ae72bef47116f1e0445db1125e2763aee9109c2978
- MD5 bf47a6d947a28ce3a6e1f3b67b182296
- SHA1 188ba19fe7846826aa439565b4574b3a74d20031
- SHA512 5ddaaa72722ce147f8497e881c0555f0c0b4924c826e03b11ad0af800f048a84684b9a8e2f1f5cc94de1621ad2391bcabb93fa93cb3d6afe430f9a38a2f83da1
- SSDEEP 24576:mVcqfqHeqNP9ynsvvNyu+lTAV+snqHnlg+awqwUwExIPfA8OLhJ9yp/xCcTOuIrg:ecqffHn4+qVt8h/qNwffAj3g/bTqSk6
- TLSH T11C95C00AF3C35E4EE76271398055A363DA527829972283EB73C97924CECC2F44E957C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
worm
Minor OS version
0
Major OS version
6
Entry point
380496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\skeet\source\repos\skeetware\x64\Release\skeetware.pdb
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetModuleHandleW
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
GetLocaleInfoA
LoadLibraryA
ReleaseSRWLockExclusive
GetSystemTimeAsFileTime
InitializeSListHead
user32
LoadCursorA
GetMessageExtraInfo
GetKeyState
UpdateWindow
PostQuitMessage
TranslateMessage
ClientToScreen
DispatchMessageW
ShowWindow
RegisterClassExW
UnregisterClassW
DestroyWindow
DefWindowProcW
ScreenToClient
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
SetCapture
SetCursor
GetCursorPos
GetClientRect
IsWindowUnicode
ReleaseCapture
CreateWindowExW
GetCapture
SetCursorPos
PeekMessageW
d3dcompiler_43
D3DCompile
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__current_exception
__current_exception_context
strchr
memset
__std_terminate
_CxxThrowException
__C_specific_handler
strstr
memchr
memcmp
memcpy
memmove
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsscanf
_set_fmode
__p__commode
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
_callnewh
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
strcmp
strlen
strcpy_s
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
__p___argv
__p___argc
terminate
_configure_narrow_argv
_exit
exit
_initialize_narrow_environment
_initialize_onexit_table
_c_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
api-ms-win-crt-math-l1-1-0
sqrtf
fmodf
cosf
log
logf
ceilf
sinf
atan2f
__setusermatherr
powf
acosf
pow
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
371KB
Virtual Size
371KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35403,
count=4, id=259, version=35403,
count=10, id=260, version=35403,
count=29, id=261, version=35403,
count=8, id=257, version=33145,
count=5, id=156, version=21202,
count=125, id=1, productName=Unmarked objects,
count=14, id=265, version=35728,
count=1, id=255, version=35728,
count=1, id=258, version=35728,
Release/skeetware.pdb
- SHA256 71f2a9034cfdff08e013ab87f4ad45981ca2fdf03dbc425f4f90a93a471e0475
- MD5 e516d85776469866c737345c1eb8916b
- SHA1 d58abc981ff282f58aaca8f8d182dc56d4612fe3
- SHA512 954eb402288fe6dbab60c1c796078910af5b182cba8176dbaa46bb5c8e1d4cfc4b69e81703a9536d8cb9046345c9ab2ebaccb9105bd218bafbb22a4f69051fa4
- SSDEEP 24576:xr796oq8RE7aWA7JTCh3q6LT/AgTWTaoMZEUV/KGCNYaEPJtEgViJle5EZ9sd:l96oq8HNWZTWkaUVSGaYaEuo
- TLSH T13ED52A63B248AD22D92B053DF2970F0CA3A69E128BDF63C7C95CE75C9CD53149E1D682
- MD5 SHA1 SHA512 SSDEEP TLSH