pp61t9.zip
- SHA256 4b9946fbf63c2bd13b805461757a67b490c7f35672b81146927e28f7264ce246
Password
androma
Behavioral task
behavioral1
Sample
pp61t9.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
pp61t9.zip
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Helium.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Helium.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
out.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
out.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target pp61t9.zip
- Size 148KB
- Sample260726-2amddsscmd
- SHA256 4b9946fbf63c2bd13b805461757a67b490c7f35672b81146927e28f7264ce246
- MD5 86e6da54baeaa34894fd78f4de5840a3
- SHA1 5eaf9b601ba2d72015d830cf589ae64417c0a41a
- SHA512 44fbe89755ec43d263ff025eb36be663de9bfd412031b2f0184d384f80694b2aa32f8dfa417031beebefd2880fc63d48e266209201458804335013909ffd55dc
- SSDEEP 3072:0K9Jy9mbAtf1PHm9Wk7e9h0g0N3Wuxcruw6dFdTvVhIydwU:uYa9iWdhtIVnw6rdDV1dwU
- TLSH T1AFE31331C372562BCC5B865E17F8613BDDA8C6FC8FEEC58131F922D6A25173382469A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Helium.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Helium.exe unpack002/out.upx
File Explorer
-
pp61t9.zip.zip 148KB
-
Helium.exe.exe 155KB
-
out.upx.exe 393KB
Helium.exe
- SHA256 7d4b1f8688accfa2b13db20aaaafd14e756b6b089bd605d741561cbc178b4a59
- MD5 97dd8e354bf62922da2c3d3b1163e02e
- SHA1 41ffd08fbe012eaca7db7fc40e56090e871a5363
- SHA512 f7641606be673da01b45ff9fd329c1aa2a13633f4c6e9ab7b7beb2553c0c06a6175d246814ec1d87e0be02eed8d27d85c00f67909a4a938aff80393534c33dda
- SSDEEP 3072:w69MRncQAo9v+owsM2yZsARRbe1h88Ul4d6LCn5rkuKFdBkbLGLj6Wu0ISjvk:HMcQxmow1sUwh834d6LMr3UdBBf6WuPx
- TLSH T113F312ADAEB742EBC9F4D63AA14F40241073B83343D741FA477527265C3F85B5AE508A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
androma
Minor OS version
0
Major OS version
6
Entry point
441264
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
152KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=34321,
count=10, id=260, version=34321,
count=36, id=261, version=34321,
count=6, id=257, version=34321,
count=7, id=257, version=33145,
count=260, id=1, productName=Unmarked objects,
count=4, id=265, version=34810,
count=1, id=255, version=34810,
count=1, id=258, version=34810,
out.upx
- SHA256 0791399aba124cfba4eae459609f21fa8eb3ed5350357cd9ca79b218a6f2730c
- MD5 93643c8f5898bc4533f77033d5ef9c8a
- SHA1 3f96f5e377c23ca497a284a74b23939292133ca1
- SHA512 d7c0e0197379b46f20766ff5cd344aeddd9eb3edc4ea1047a9f3786577f7d18f673afba01473ce661a1e74f99fd9c77374b31b867cac6c1a0208bf2c472a05c9
- SSDEEP 6144:MZ0F0tpTLRPlZTJuL7LOtLcU96tGph0lhSMXlBXBWn68dVxFBdciH/:gtpTDNyPOBVph0lhSMXli683
- TLSH T1E5848D22FBD142B9D29BC17989678D05F73238CD03A156CF33DC89A12F666E15E3E641
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
184708
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
186KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
472B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=34321,
count=10, id=260, version=34321,
count=36, id=261, version=34321,
count=6, id=257, version=34321,
count=7, id=257, version=33145,
count=260, id=1, productName=Unmarked objects,
count=4, id=265, version=34810,
count=1, id=255, version=34810,
count=1, id=258, version=34810,