50_fut-rama.rar
- SHA256 b6bba02fc7f08249daf9a27e1193a77d01e412ee95a14f36ee1c560a22216dc6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Futurama/futurama.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Futurama/futurama.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
Futurama/futurama.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Futurama/futurama.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 50_fut-rama.rar
- Size 125KB
- Sample260727-plpxfasble
- SHA256 b6bba02fc7f08249daf9a27e1193a77d01e412ee95a14f36ee1c560a22216dc6
- MD5 300717e1476c0435868489e1993bd312
- SHA1 9b4ba6ee2c11b76f2707b7ab135bf73a609d8c4b
- SHA512 d64779b939a377bfb62daa2860cf7bd76202d0b66a9c8a8fb1998120a43613b97784d95ccce7e37b75a86af2b3dbeb7e69e08b25924ea09c19ac3bdd9f3f7a94
- SSDEEP 3072:vxLKXmc4WSSNqZ022FZnHIsQEGzSmBs3UMg:vYXzZ0Z0xnHGzhBb
- TLSH T1F1C312164604C3ECEC996EC9DA8781C713D18A3AF0FB29B3511716F8944F1F26686BED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Futurama/futurama.dll unpack001/Futurama/futurama.exe
File Explorer
-
50_fut-rama.rar.rar 125KB
-
Futurama/futurama.dll.dll 18KB
-
Futurama/futurama.exe.exe 232KB
-
Futurama/futurama.ini119B
Futurama/futurama.dll
- IMPHASH 6ec4162549bd3d87b6109c7a4b826464
- SHA256 e25dba73d523da1117fe273222ac81d0b82c025858a1cc71783bd25d6db2f603
- MD5 cb9b554b6ca2e7789e8d4207ceb30651
- SHA1 f9eeead22a7e3a8030bbf3d88acc4c4ca25ce779
- SHA512 260a8a31a6e5bf966787a0034d94d3763bdac7a26f5f82fceff4f34c57076802b648c1fe296d95b2ccf394d984a0f6402d95ea6b88aca051a348ee7f949ab1a9
- SSDEEP 384:vAfyaNSECwUaj9fnlN6pg9KXHf5CUKBgskqy:oKaIXrBBCUFlqy
- TLSH T158826B09E90254B1F5B310BAEDFB71760BAC1C33035221FFA6C3168E1AA84D332759B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
5389
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetTickCount
GetPrivateProfileIntA
Sleep
GetModuleFileNameA
CreateThread
GetProcAddress
GetModuleHandleA
VirtualProtect
GetPrivateProfileStringA
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
user32
SetCursorPos
GetAsyncKeyState
shell32
ShellExecuteA
msvcr90
malloc
strstr
atof
memset
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
free
sqrt
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
memcpy
_encoded_null
strlen
strcat
strcmp
opengl32
glBlendFunc
glColor4ub
glEnable
glLoadIdentity
glPushMatrix
glPopMatrix
glBegin
glDisable
glEnd
glVertex2i
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=62, id=1, productName=Unmarked objects,
count=17, id=138, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Futurama/futurama.exe
- IMPHASH 28139179ae6da2af701794f165071890
- SHA256 3dd156a6b29f580e0c5ee84a9307474127e0ae03d925290e8f7b72605f7ff47f
- MD5 0993abe02b2fbc959c9e43c1d92d4960
- SHA1 a0a58e8f5526c2c8a80fa906cdddb65a6d5f0c7d
- SHA512 15ef3ce107ee28b43ec49e048649dd8c0f6cf36c17b801a31aca3f9eb3f4ca9589554a15524e85ce6de236c990d8f9b990c8ed100ee17e96609e02111ae58a9d
- SSDEEP 3072:CnXbReSZS92bXrPpQJ+vmxaRPxM+BWnTostHpuXGrD2xutqix7REe:IReSS8bXrPpQIvmwM+BWdtHIGrF7REe
- TLSH T1A2349D0D55118DD2E50C1172342ADEB4E7A4F9A9206922EE9F877CB2FBC33767A02F54
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5545
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Coding\C++\Von Mir\Clientside\moribase\loader\release\loader.pdb
kernel32
ExitProcess
Process32First
CreateRemoteThread
OpenProcess
Sleep
VirtualAllocEx
LoadLibraryA
Process32Next
GetModuleFileNameA
CreateToolhelp32Snapshot
CloseHandle
WriteProcessMemory
CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
user32
DialogBoxParamA
EndDialog
msvcr80
_configthreadlocale
_initterm_e
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
__setusermatherr
Name
.text
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
216KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=125, productName=VS2005 build 50727, version=50727,
count=20, id=109, productName=VS2005 build 50727, version=50727,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=54, id=1, productName=Unmarked objects,
count=1, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Futurama/futurama.ini
- SHA256 721110deac13d652952b6f47b209236a36993b3718af14b31c280752748bc652
- MD5 ec0cc6c9db83404538f9f79401c1ee37
- SHA1 fefc60019e9bef8d3c0cc198c7c274c1c91f07ba
- SHA512 993ce7a68423f8bf2950cbe1de1cc311b930148f402a03248279d99c0146fd6c4c770e9be2477912e2584c819d39c79143b2a2a2992e2be103663dd130df6055
- TLSH T1A8B01213A3833AACC2B006086B7A44E273A8004001F1F916B7443C9D3F8C82434ED4D5
- MD5 SHA1 SHA512 TLSH