philipp_stealer2.zip
- SHA256 3f8cc22ac09baed7b549f0305432825431e8869e8ef7fb091de608c8c57c79c5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
msedge.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
600 seconds
General
- Target philipp_stealer2.zip
- Size 442KB
- Sample260724-krf49swdja
- SHA256 3f8cc22ac09baed7b549f0305432825431e8869e8ef7fb091de608c8c57c79c5
- MD5 1e2cb8e6e1ec8bc2f00a942c32d15fa5
- SHA1 14e25a560c8b0540f64c32e2dea904f229006ac4
- SHA512 6b8a5f30cea7fb9b70ed03cd988ebd013f632e2b1bac78c2e929cc6c7271eb5c0f20b24b32a696f9d6760528486ffa78b4e39f8255e814d7161b5a99d3a21996
- SSDEEP 12288:CtXMDpbK1Ii78vEJ83k+3Eu1wL3q6Pj/SstJQanJkSekPEQ:CJYpbcL7gEq3kC1wL66PD9CanPekP9
- TLSH T16BA423AAFD3431F73D811B589894C81ACD91AAD3D97D06EE7C2C2E022D6D88593F605F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/msedge.dll
File Explorer
-
philipp_stealer2.zip.zip 442KB
-
SAM.dat6KB
-
ke261KB
-
msedge.dll.dll 106KB
-
sc135KB
SAM.dat
- SHA256 0d1b3ef580115501fe2f29c86d2ce75f2c84245c6846995b10a339dc8a79d329
- MD5 2e91548d0d2f4d8784e458e86bb1fcab
- SHA1 c2b9beae16dbd9813535fdf0d7c5e558cba7edf9
- SHA512 0fd30851a165c29049da02b37ecc9e1f8f7455d40a6150fc1f47ff269f7e6ba7cf5ac120192c0976899d51229c2b49617fc40309b070183bbefe3076691922d2
- SSDEEP 192:zahK8HAau560uXNeLx7DxlweHSxzbOXIyddC:z+HAaatKeW/b9yfC
- TLSH T178D1AF632DA4FFC6874E68E48127377B5EF96D924E3D3F4584738ED1598ACDA088118C
- MD5 SHA1 SHA512 SSDEEP TLSH
ke
- SHA256 f7e9e020be888191590d983619c5cba967930e793113b6167cc6ebb48a3d8e40
- MD5 cbd38459ad195be12843f0ee3ad427b8
- SHA1 3e59a482df64e99ed0b3b0d837531a204eddc9ea
- SHA512 91547a2007510bfada0e39dbdd3631fa54b4ccbadcc18ea1d1d55e3036082ec6f9697adcba6427e8f32bb8e7d5ce1a2d3db09510d08b6dfc52d5b860d2095cf3
- SSDEEP 6144:Lt5HkbXD35Oevk39IiiyHcKOgg/X8Js6S3ZuXOjGZXdm1wsQ:Lt5qDpbk9IihGv8JE3I+jGm1wt
- TLSH T1E84423ABB428A2F739512BC769488C51D481CFE3ED7D00AB7D1D2E113B5D88942FE25B
- MD5 SHA1 SHA512 SSDEEP TLSH
msedge.dll
- IMPHASH 03371b3b4516113c8e77e74299320165
- SHA256 794a53776783bbe9565219b4c3ba2a99a92b32b08b9bbabe62747c83bd1e10f8
- MD5 de2c860873e7f6e60c69f531884e5caa
- SHA1 946ea6f7b52b53e8e437359362d8f739b3c6d329
- SHA512 e1a8e8881b2e98d67564fffeeb60019d42cf98bab5200dcbdfa9d5f25f8a7f6cfa57395e30860574370c6310a6479ccfc39fcd43ab32c5994e29572e84d32f42
- SSDEEP 1536:xQAf2GKHFLBOCNwc1TCq0XZzwsFD4qEnJyw8VzZqU35VwneghARA02e7UqnoqLw9:9hO+xjbeR9tfMUPWUniyx
- TLSH T1CBB3078A9C132DBBC005DEF4CD129900EA70FCC5479A5FDF67505CBA5E12AD8EE29B42
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
59184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
LoadLibraryW
GetModuleHandleW
GetProcAddress
LocalFree
WideCharToMultiByte
Sleep
LocalAlloc
SetEvent
CreateEventW
WaitForSingleObject
CloseHandle
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
msvcp140
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
__std_type_info_destroy_list
memset
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__std_terminate
memmove
_CxxThrowException
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_invoke_watson
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_execute_onexit_table
_cexit
_register_onexit_function
_initterm
_initialize_onexit_table
api-ms-win-crt-convert-l1-1-0
_wtoi
strtoul
api-ms-win-crt-string-l1-1-0
strncpy_s
_wcsicmp
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
RundllEntryW
ServiceMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=20, id=261, version=35207,
count=3, id=257, version=33145,
count=107, id=1, productName=Unmarked objects,
count=12, id=265, version=35225,
count=1, id=256, version=35225,
count=1, id=255, version=35225,
count=1, id=151,
count=1, id=258, version=35225,
sc
- SHA256 999ed5896fd757b928f89b71f5101abb332013696cacde18dea3f290e01f1edb
- MD5 6999a1adaec7da906c7f57db567ff200
- SHA1 899559ef97c6e2910e45fb1f14f60322e39b0f1f
- SHA512 fbf963b4d8320b898c9b1e6552d635f5be13948019d65b1fbfc0ebf10941c2cbe4a762e40c322f84f30e36296258c4bcd05aa94527c9a07001dc2f6778586569
- SSDEEP 3072:HJSbQA56G9ChBJkc2QqpcAY8jnWuE0DXPtBGzp:HJSbQZXzJkcecAY8CwfUp
- TLSH T181D313A4EFAB25DA49891724CDE4C00E9C7474C06285EFECA85C99974D3E847FBB244B
- MD5 SHA1 SHA512 SSDEEP TLSH