123.rar
- SHA256 cff8be8957319c37a36e4be62146cad3453f36fcaa0b4780e90926904f04e2de
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Debug/net8.0-windows/9et.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Debug/net8.0-windows/9et.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Debug/net8.0-windows/9et.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Debug/net8.0-windows/9et.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 123.rar
- Size 74KB
- Sample260719-fpca3sey8x
- SHA256 cff8be8957319c37a36e4be62146cad3453f36fcaa0b4780e90926904f04e2de
- MD5 4ea824f3bb59804db0b6494461f62999
- SHA1 7b0a8efcbb4a79aa2a67b72e0232a0729c807c6d
- SHA512 eae42a8d5ce8d58696c85a270205289a0e19dbdafdcda863bfd8f5b56adba217b48b3a21e9484a5a98554277ee2a14ec057b006a76cedd20dd365429706ff85d
- SSDEEP 1536:Vuyqk5SoU+P7X+6c5p6sBQ0PdoTKUW+tWpfMdHdrADe6bvmA3VzfpumRRC:xqQE+u5BbckpfIdrA6WvmQVrprTC
- TLSH T12F7302F81021EBB0E72B9B55D4876F5382BF57006B946C8A44329F1561AD888326FE8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Debug/net8.0-windows/9et.dll unpack001/Debug/net8.0-windows/9et.exe
File Explorer
-
123.rar.rar 74KB
-
Debug/net8.0-windows/9et.deps.json401B
-
Debug/net8.0-windows/9et.dll.exe 16KB
-
Debug/net8.0-windows/9et.exe.exe 148KB
-
Debug/net8.0-windows/9et.pdb16KB
-
Debug/net8.0-windows/9et.runtimeconfig.json357B
Debug/net8.0-windows/9et.deps.json
- SHA256 c5f719bdf106a1779ae36db235af6385473d3dbf4dedd51a8fbbedf115c153ff
- MD5 50be2da0c501934fb8422441f67cbcce
- SHA1 c64c92dbf9ebf2e515d5d5102f03aea40d3b6c85
- SHA512 bfd2e7c3d9077bc2f41f49f72ee4c1023b124e6fb85aca0cf908c7e3126260b0adaf47ef584acf1a097ea03a02da85dbc02bf52308837f5e882247832ebbffd3
- TLSH T1D4E04F19D5940DAB01F223B65536C393F572573300251C1E79FE841C0F7695B9491F69
- MD5 SHA1 SHA512 TLSH
Debug/net8.0-windows/9et.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 68ab915ec716e2cf5f3352fcd2e711ecefe7d20b6a1e2e3bea33fe4fcf88d99f
- MD5 07da17b121c7032376440c2d853ed16c
- SHA1 219fd3974f6dcc128ba448da9c66397becdfd6eb
- SHA512 70963cf477de0bd5cc096dfc5644b7cfd8d1faffa5e7662c6271ac95ce1376c48f412655ed7d82db5e6d2f55ac547e4f533407abcbf374040f1f3917b66ab70d
- SSDEEP 384:b7MqdB+4N5mpSVJ4zOpkjrqjVn5gIO2Qn4CpML1uV:cqdB+QjyNneuV
- TLSH T110721A48B7D9C414D47A1AB0DDF3E3295734E9C28E65CB4F1CCBA4C71AAA7844BA4B70
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\ft305\Downloads\files (13)\tools\obj\Debug\net8.0-windows\9et.pdb
mscoree
_CorExeMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/9et.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 8b3eec1c36026d20e9047eb5851b649575d9d043d0123523ab8741ff5164b642
- MD5 4c07a9ffd4f6c223ac20428b974c6766
- SHA1 03d66c54b94af5c03fa2d5ddb9c2c3e7b7df4a28
- SHA512 d080f6d6b1677c2775c70b0aa34b2507c1afab447bffd2c7579cea4dd868f23fa196da7787b7d397f8d75a61f19d25e4d1e1a53f24fe656fb802932c818a7e7d
- SSDEEP 3072:sqeXA/4yIg9vkNPNu6H6xCYOiVUE265UJO:svgvkNFNaxmNE0J
- TLSH T103E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Debug/net8.0-windows/9et.pdb
- SHA256 379125a4d7df05184e6f39de581e728e76b6fa826d672a0319368f2a8c64cf48
- MD5 04718cf45480862f128b893c7a95966d
- SHA1 f736a3c1d40f19fd877b9394c83dbb60b841e371
- SHA512 753b23125217459c72a2ca77ebc8c42c57cb95f5898337694257c7438786f8d10a0f8ce367fe2d5246b43b2bd61b8fbd54f46d3727fcb9b430ad99e92adf002b
- SSDEEP 384:KSmQXI6xxwJskw6l4D7aIXzsZ1cBa17kG7KT7BirycN0aDj+0exHTfyv8G7ldfY1:nFXT+7kCs6rNFfYpA16
- TLSH T13F7291379399DA21D60622325936C39CB7B0D3052701EFBAF1D82758DE9FBC81BB6161
- MD5 SHA1 SHA512 SSDEEP TLSH
Debug/net8.0-windows/9et.runtimeconfig.json
- SHA256 a6a31e881a564ce497254b0cc044c32ade3cf5f02c6501e43c8425e8698b2c00
- MD5 35bc322bd42045632a8cb4fce81a90d2
- SHA1 351f78a6441ac2c8a34a03d92561000889260326
- SHA512 747651399d598da800d2d0090924b682bac3578c6718adf60cd6d99fa4f89ae8c343addb97476b64597c59007b2259fdc1a49380d7c33c8cfe220a30201ee718
- TLSH T192E08C3AC9144DA315F53BBED52AC287FE3047AB0158092AB6BC441C1F725625000F88
- MD5 SHA1 SHA512 TLSH