681cb77a7cf9b49752cb19d589e41bf433f17671a3a252fecfffda55b8e18e59
- SHA256 681cb77a7cf9b49752cb19d589e41bf433f17671a3a252fecfffda55b8e18e59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
read_inf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
read_inf.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 681cb77a7cf9b49752cb19d589e41bf433f17671a3a252fecfffda55b8e18e59
- Size 19KB
- Sample260722-ev1eescr6w
- SHA256 681cb77a7cf9b49752cb19d589e41bf433f17671a3a252fecfffda55b8e18e59
- MD5 21e072efff22c655464c66e2159ea5fc
- SHA1 a80443355a97f91360f736728db8f5130adbf33d
- SHA512 02738498cf65669aaa638a26bba1e9f90ef947c35804f43d684e4f711a693a4eb8e4d85cd401f7f9dbe4e09fada36056ecb9fae4a93ebb22f9929bc6024e204a
- SSDEEP 384:hEnRKY47+KBfKwGA3s9byA+vPB6nDshjTENRzka09oDPNVMjDhTRZj6jUgFmhgsh:2npQ+KaCsQA+vZ6uM+a09o7shTRRgFQ/
- TLSH T1ED92D0DE05E6A199FE1EE6FB711C6E0DE0E8CA3C618345343DA89A7038DB39464E5437
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/read_inf.exe
File Explorer
-
681cb77a7cf9b49752cb19d589e41bf433f17671a3a252fecfffda55b8e18e59.zip 19KB
-
read_inf.exe.exe 64KB
-
说明.txt976B
read_inf.exe
- IMPHASH 1017a8f7df91eb3aba4d807a1da7ab17
- SHA256 a2d45ba8030f75969b9c12f300c258fcfae824b433eaf33edc039489a8839d41
- MD5 12640a5877a58c3652d66ea87ef7a820
- SHA1 d08a0dcfdaa53f6a27680f7957604bd4672f050e
- SHA512 763c8720af78b3a94cec5cf8ef3affa29772e9c196e30a6094d2b057ed2eafd1c7a51fdc4c39daae2edccb44c86c30d0abfaf01e7eac3f0ea1cad5ea7b9b80ae
- SSDEEP 1536:78wcFCqqqqqqqqqqqq2QUaWvzFeKgbUzr09dClXy+:78wACqqqqqqqqqqqq2QVW70KgRd8
- TLSH T1EE5362D47AD44CD6EE14623C91E69272263CBAE4C64347076920B7312F23FD53EE662E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
GetCurrentDirectoryA
GetFileAttributesA
GetLastError
InitializeCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
__C_specific_handler
memcpy
memmove
strchr
strrchr
strstr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_initialize_narrow_environment
_set_app_type
_initterm
_initterm_e
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vsprintf
fclose
fflush
fgets
fopen
getchar
puts
rewind
setvbuf
api-ms-win-crt-string-l1-1-0
_stricmp
strcat
strcmp
strcpy
strlen
strncmp
api-ms-win-crt-utility-l1-1-0
qsort
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
720B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
608B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
9.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
512B
Virtual Size
202B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
512B
Virtual Size
163B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
说明.txt
- SHA256 6ac9480ba27aa4270487edabbd9e82ea370f935b716c50486470b18120ef6f44
- MD5 a9f49df636c31d4176d5b3cff6d3955b
- SHA1 e1cafb2d8b4253913c1015481c00a37c29732832
- SHA512 771f0fae7482c2787e1869c6cdf58a75dee9f25ac1b7717223744b9d4cffdf3651c6f63fb5af527bc4863a8cee633b4f35eeccdcc3d3b9fb8896ce9f6265eeb7
- TLSH T1AE1100128A3B41435AB990F1405A45C27A271E56483A3264387EC6EDFB5975CF6C8E70
- MD5 SHA1 SHA512 TLSH