philipp_stealer.zip
- SHA256 35f862c919d588f6d947b368d00bddbaf461cf9e00d7774c22bce59456734875
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
msedge.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
General
- Target philipp_stealer.zip
- Size 436KB
- Sample260724-h89rssvcld
- SHA256 35f862c919d588f6d947b368d00bddbaf461cf9e00d7774c22bce59456734875
- MD5 d2f245c8d6f7615f1274cfca61c5a26f
- SHA1 e3877b7a7207fc3bbcb9a5611721ac424ffa0972
- SHA512 4a4ecfb4acdc8610159105c0dd0e9984aba49634f6ab675d22225bde8a5d654f86b0f53f39632066670a4da90290072e948a3c5ad2e64fadf27b1f8ad4117f62
- SSDEEP 12288:CtXMDpbK1Ii78vEJ83k+3Eu1wL3q6PjkJQanJkSekPER:CJYpbcL7gEq3kC1wL66PACanPekPO
- TLSH T1639423A9FD3421F73D811B4898D4C81AC9809AD3D97D06EE7C1C2E032E7D88593BA45F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/msedge.dll
File Explorer
-
philipp_stealer.zip.zip 436KB
-
ke261KB
-
msedge.dll.dll 106KB
-
sc135KB
ke
- SHA256 f7e9e020be888191590d983619c5cba967930e793113b6167cc6ebb48a3d8e40
- MD5 cbd38459ad195be12843f0ee3ad427b8
- SHA1 3e59a482df64e99ed0b3b0d837531a204eddc9ea
- SHA512 91547a2007510bfada0e39dbdd3631fa54b4ccbadcc18ea1d1d55e3036082ec6f9697adcba6427e8f32bb8e7d5ce1a2d3db09510d08b6dfc52d5b860d2095cf3
- SSDEEP 6144:Lt5HkbXD35Oevk39IiiyHcKOgg/X8Js6S3ZuXOjGZXdm1wsQ:Lt5qDpbk9IihGv8JE3I+jGm1wt
- TLSH T1E84423ABB428A2F739512BC769488C51D481CFE3ED7D00AB7D1D2E113B5D88942FE25B
- MD5 SHA1 SHA512 SSDEEP TLSH
msedge.dll
- IMPHASH 03371b3b4516113c8e77e74299320165
- SHA256 794a53776783bbe9565219b4c3ba2a99a92b32b08b9bbabe62747c83bd1e10f8
- MD5 de2c860873e7f6e60c69f531884e5caa
- SHA1 946ea6f7b52b53e8e437359362d8f739b3c6d329
- SHA512 e1a8e8881b2e98d67564fffeeb60019d42cf98bab5200dcbdfa9d5f25f8a7f6cfa57395e30860574370c6310a6479ccfc39fcd43ab32c5994e29572e84d32f42
- SSDEEP 1536:xQAf2GKHFLBOCNwc1TCq0XZzwsFD4qEnJyw8VzZqU35VwneghARA02e7UqnoqLw9:9hO+xjbeR9tfMUPWUniyx
- TLSH T1CBB3078A9C132DBBC005DEF4CD129900EA70FCC5479A5FDF67505CBA5E12AD8EE29B42
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
59184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
LoadLibraryW
GetModuleHandleW
GetProcAddress
LocalFree
WideCharToMultiByte
Sleep
LocalAlloc
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
msvcp140
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
__std_type_info_destroy_list
memset
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__std_terminate
memmove
_CxxThrowException
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_invoke_watson
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_execute_onexit_table
_cexit
_register_onexit_function
_initterm
_initialize_onexit_table
api-ms-win-crt-convert-l1-1-0
_wtoi
strtoul
api-ms-win-crt-string-l1-1-0
strncpy_s
_wcsicmp
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
RundllEntryW
ServiceMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=20, id=261, version=35207,
count=3, id=257, version=33145,
count=107, id=1, productName=Unmarked objects,
count=12, id=265, version=35225,
count=1, id=256, version=35225,
count=1, id=255, version=35225,
count=1, id=151,
count=1, id=258, version=35225,
sc
- SHA256 999ed5896fd757b928f89b71f5101abb332013696cacde18dea3f290e01f1edb
- MD5 6999a1adaec7da906c7f57db567ff200
- SHA1 899559ef97c6e2910e45fb1f14f60322e39b0f1f
- SHA512 fbf963b4d8320b898c9b1e6552d635f5be13948019d65b1fbfc0ebf10941c2cbe4a762e40c322f84f30e36296258c4bcd05aa94527c9a07001dc2f6778586569
- SSDEEP 3072:HJSbQA56G9ChBJkc2QqpcAY8jnWuE0DXPtBGzp:HJSbQZXzJkcecAY8CwfUp
- TLSH T181D313A4EFAB25DA49891724CDE4C00E9C7474C06285EFECA85C99974D3E847FBB244B
- MD5 SHA1 SHA512 SSDEEP TLSH