HarmFulCityNoSongs.zip
- SHA256 fb46493660f101de3bc8e4ff19f524b6e22d09ebb75bd6f069bf672445877b39
Overview
overview
6Static
static
3HarmFulCit...gs.zip
windows10-2004-x64
6HarmFulCit...gs.zip
windows11-ltsc_2024-x64
1HarmFulCit...C2.exe
windows10-2004-x64
1HarmFulCit...C2.exe
windows11-ltsc_2024-x64
1HarmFulCity/bg.jpg
windows10-2004-x64
1HarmFulCity/bg.jpg
windows11-ltsc_2024-x64
1HarmFulCity/icon.png
windows10-2004-x64
1HarmFulCity/icon.png
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HarmFulCityNoSongs.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
HarmFulCityNoSongs.zip
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
HarmFulCity/HarmfulC2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
HarmFulCity/HarmfulC2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
HarmFulCity/bg.jpg
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
HarmFulCity/bg.jpg
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
HarmFulCity/icon.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
HarmFulCity/icon.png
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target HarmFulCityNoSongs.zip
- Size 833KB
- Sample260719-2p86psew5q
- SHA256 fb46493660f101de3bc8e4ff19f524b6e22d09ebb75bd6f069bf672445877b39
- MD5 cfe617a9ed21e9fde1adbcc49bb7037c
- SHA1 09ec1875f599e611a75d01580f4178d78f3bbcf0
- SHA512 365c0628fc0f8f0ace1dd38a2e4f840364969a233d072ae1041ddcb2e6ef980c8e6ba68da375a6f35818d6926c8da4806a3cffa84543317d2801f15e4bf5b0dc
- SSDEEP 12288:ghz+9WiTWuKZc+HEqbDZ/9DTeEixmdq+TKd/CWnG9Z1PAnJSkAF9TlH8w35zJi7n:gVCj1kDZ/9DTS+leGFwAXlc25zIb
- TLSH T1D105338B18AF7FDA3A796BCE4CF122E017058F5F584118E1624E76AB41F7253A3814E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/HarmFulCity/HarmfulC2.exe
File Explorer
-
HarmFulCityNoSongs.zip.zip 833KB
-
HarmFulCity/HarmfulC2.exe.exe 3.1MB
-
HarmFulCity/bg.jpg.jpg 34KB
-
HarmFulCity/icon.png.png 58KB
HarmFulCity/HarmfulC2.exe
- IMPHASH 0c289e610a820dacda8f3d5fe745c0a6
- SHA256 a208e3884520066e119fb0283bb8f38995a191e31377de88115c1add376329a0
- MD5 70e7275190433ac4dbdfb286eb5cf99f
- SHA1 2a9f461730aab22f882d8748de08e12a7ab303b1
- SHA512 59857ac9af6310a893043a7826cb18bd3a339e21a098b4bfe43f87d1148e32c095987d2bb8efc3f95d1c5df0171faf4d4cf314f62d9494ec842d23ee2d65d8ee
- SSDEEP 24576:hUrMa6NGGhorWpUr7gyGXdNt9T9ZeJSDYk3AMFMC5:sMa6NpKdr7gPHfqS5Az
- TLSH T1ACE5D917F7B651D1D1BAC038D553622AFC7134A6833897EBA2C18E461B60BE8EE3D741
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1239286
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\holyc\Documents\HarmFul\bin\HarmCity\Debug\HarmfulC2.pdb
kernel32
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
CloseHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetFileSizeEx
VirtualProtect
IsThreadAFiber
GetTempPathW
SetConsoleCtrlHandler
WriteConsoleW
OutputDebugStringW
GetFileType
HeapQueryInformation
HeapReAlloc
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
SetFilePointerEx
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetTimeZoneInformation
FindFirstFileExW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
CreateFileW
SetEndOfFile
GetModuleHandleW
GlobalLock
GlobalUnlock
GlobalAlloc
GetModuleFileNameW
GetTickCount
FindNextFileW
FindFirstFileW
GetDateFormatW
FindClose
GetCurrentThread
WriteFile
GetStdHandle
ExitProcess
IsProcessorFeaturePresent
GetModuleHandleExW
TerminateProcess
GetCurrentProcess
GetSystemInfo
HeapValidate
HeapSize
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
GetProcAddress
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
RtlUnwind
RaiseException
IsDebuggerPresent
GetStartupInfoW
SetUnhandledExceptionFilter
GetCurrentThreadId
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LocalFree
GetLocaleInfoEx
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
ReleaseSRWLockExclusive
user32
TrackMouseEvent
GetMessageW
TranslateMessage
DispatchMessageW
RegisterHotKey
UnregisterHotKey
PostMessageW
DefWindowProcW
PostQuitMessage
RegisterClassExW
CreateWindowExW
ShowWindow
SetWindowPos
SetWindowDisplayAffinity
IsIconic
IsZoomed
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetKeyState
KillTimer
UpdateWindow
SetWindowRgn
InvalidateRect
GetClientRect
ScreenToClient
LoadCursorW
LoadIconW
MonitorFromWindow
GetMonitorInfoW
SendMessageW
GetDC
ReleaseDC
BeginPaint
EndPaint
FillRect
LoadImageW
gdi32
TextOutW
MoveToEx
SetTextColor
SetPixelV
SetPixel
SetBkMode
SelectObject
SelectClipRgn
RoundRect
LineTo
GetTextExtentPoint32W
Ellipse
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePen
CreateFontW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
Arc
GetStockObject
CreateRoundRectRgn
winmm
timeSetEvent
PlaySoundA
timeBeginPeriod
mciSendStringW
gdiplus
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreatePath
GdipDeletePath
GdipAddPathEllipse
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateHICONFromBitmap
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawEllipse
GdipFillRectangleI
GdipDrawImageRect
GdipDrawImageRectI
GdipSetClipPath
GdipSaveGraphics
GdipRestoreGraphics
GdipFillEllipse
msimg32
AlphaBlend
Name
.textbss
Size
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
431KB
Virtual Size
431KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
114KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
1024B
Virtual Size
862B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
777B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
1024B
Virtual Size
563B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=182, id=261, version=33145,
count=21, id=260, version=33145,
count=17, id=259, version=33145,
count=10, id=259, version=35721,
count=18, id=260, version=35721,
count=89, id=261, version=35721,
count=13, id=257, version=33145,
count=210, id=1, productName=Unmarked objects,
count=2, id=261, version=36251,
count=1, id=255, version=36251,
count=1, id=151,
count=1, id=258, version=36251,
HarmFulCity/bg.jpg
- SHA256 713b0c42ef532e487b92dc1e72d2b1a05df28143eed5b9e0d36cf29d7066b1fd
- MD5 ca4a3921200347b8f03abe707db7fbe8
- SHA1 8e98a20a5591889bd58e2f5ffda6ac2ec85764ac
- SHA512 eed265254fc3042017606d759dcb898b1e0e8fcefb12ad533db95e07351ea6c3611f14edc92821ca8b1f76b65d4fd0ca74a6e6e013b6e797db496b79b34c0fda
- SSDEEP 768:gYyR71CAOSSYRZUFxpvzuW/FVQuSCYTQyhHIDVSC2U:gFZCAOSS8S/Qu+MhRSCZ
- TLSH T1CCF2E1F633AAC7E1E5A5CA3804AD0365B2D5DDE6F247B64D6119E137002B2B11FCA487
- MD5 SHA1 SHA512 SSDEEP TLSH
HarmFulCity/icon.png
- SHA256 42ed040ea6aaa04bdc8f99ce005b1c4c837acf4e492fe08b8990a576723ad669
- MD5 d1886910829b95f0fb2b0db654fcb0fb
- SHA1 5850c3a0bc3e165f3bf943aebf3285c55c8572bc
- SHA512 efaa01153e717fe3b11059a43ab5fa7239ae2d6f98bc80a9b9086f8fd84c0f7040a8ec1262494ca8b7819fcb78fd5ea4febdce5e578e1a28dea21fef909dcd30
- SSDEEP 1536:G5DkMuukk+uu8/yGfneOzYN5JuAiX3JYDmBemfiTZD65Apm:I7eUqwnhzK5eXqDtmaTZTm
- TLSH T15043018D6DC0D27AC492149838ACFD41DE93B8DD9731B25542CD257F6B06AC3B2C77A1
- MD5 SHA1 SHA512 SSDEEP TLSH