8u9iyg.zip
- SHA256 21d20edb21ae48ecd87bf44d2bb5a5defb644e83e5615419f5633c54447b1ae9
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
patch_8u9iyg.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
patch_8u9iyg.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
usbmon_8u9iyg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
usbmon_8u9iyg.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 8u9iyg.zip
- Size 1.4MB
- Sample260724-xyydcabm6w
- SHA256 21d20edb21ae48ecd87bf44d2bb5a5defb644e83e5615419f5633c54447b1ae9
- MD5 a7dafb87aadba99c5feac917ac68cb7c
- SHA1 c3074f49a9e9b44be77763a3131a76f6ce57b185
- SHA512 5974ba43d5b00ad64d390666488d50c8d254851e2fd7fcd21684bbdedd2f31dd1489d1714b4b1945f0a053d00869d00f0b0f4829b6d946845ea16b45f7f9034b
- SSDEEP 24576:iFRQuULs5GrQXHwIPo7YsqbXBa9t4+5SkkwugEft2ACu90fKHRtKEq4:iQuULMG0XvossqbQt4+5HkwcAxALHRtB
- TLSH T15D6533B1B6FE6E341A63E6015FB024706363DEB5DE04C6DD290B91198EDFB492B4C42B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/usbmon_8u9iyg.dll
File Explorer
-
8u9iyg.zip.zip 1.4MB
-
own.enc700KB
-
patch_8u9iyg.bat.bat 1.0MB
-
usbmon_8u9iyg.dll.dll 14KB
own.enc
- SHA256 6aca96edc6d2e009d078a05907283f4e20e570393f758b7e4cd29ea868d60040
- MD5 efd38941b0f5b7becd3493b233755c91
- SHA1 c584ee558bee29783e440114d80feacb1eaef49f
- SHA512 497a8b31eb84d6a9c6ce06544aa1e7924d75aa3e23cdaf48a8cf2f214e65fef13ec63d4a2c41b56b9066b64f583925003973725a071a5c041417c671678018d2
- SSDEEP 12288:3/FHPG7TVuWVsqCxwYIWZDUHiXhyoa0tEn5XBqb6qrXpa0TwK4b:P1PWuWVsBwdCXhU0tA9C6qrXpaB7
- TLSH T174E43352AFF198353427EA412FA82C6113D37DE6DE0CC1EE2E06E139395AB95174EC39
- MD5 SHA1 SHA512 SSDEEP TLSH
patch_8u9iyg.bat
- SHA256 6945303eb8b013ae5eaaa2071899c50400aed9f7465a2c80802b9d315858a450
- MD5 b2a17bd82047308afb8672cd6f11d517
- SHA1 07cfcbb263c63dad4c18880882d0f7eccc16ef4f
- SHA512 dbf0859d5b6fc7f8cffcb76446eb9bc4646dc06ba827ce0d1fadcbdeb9a966f97e2ef19327fd3e51dc70c68b296c012293745e215ee899912f88e4dd55fa89f1
- SSDEEP 24576:nfhaVv880v9NBXCwDDUVPmsx1TYQBXmGv0OUX9:gm8k9NXoTXBWGcf
- TLSH T10325333D3F1929527C1D4545CA3E681CBC1FF8ABA7B5DC059897F5B241A29C8BB0E80E
- MD5 SHA1 SHA512 SSDEEP TLSH
usbmon_8u9iyg.dll
- IMPHASH efd7f22fecb87f90fef74b8027a9ff28
- SHA256 d927e11dac042493b09ccb35b5a402e9eb550a5a2a5263b52aedfa70854072d9
- MD5 12caad188354bb95f319335140a251ed
- SHA1 6358277a6b1d756d41564e1d0d949b605a651f14
- SHA512 518c7e54ccf806270f781ccd99ed6aa6de0b82145d0c8ee559b5d9f58d6de0048b29f1b4a868b976fe30371607e35cbf628b7a4b4ffc05444869f43a2c17694e
- SSDEEP 96:GuEtq/3VEgUd/v/F6P0z59VFaA2g4/JAFsWIycj17GBbqPe1ZyaxEAheHSbSnfDf:JEtSFEfdPKuMAFP81Ks21ZyaXeqd4L
- TLSH T1B362B70E321358D9C90AD47991EB8F79ABF1B801C9E79B384334DA363E507B5762EE44
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileW
CreateRemoteThread
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetProcessHeap
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
OpenProcess
Process32First
Process32Next
ReadFile
Sleep
TlsGetValue
VirtualAllocEx
VirtualProtect
VirtualProtectEx
VirtualQuery
WaitForSingleObject
WriteProcessMemory
lstrcmpiA
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf
wcscat
wcsrchr
Run
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
68B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ