out.zip
- SHA256 4ec412a6db30447e7e732517be24a93c4fc77278718b1f82f1854d6a2f6ad89e
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
out.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
out.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
out/libvlc.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
out/libvlc.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
out/vlc
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
out/vlc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
out/vlc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target out.zip
- Size 1.1MB
- Sample260727-ppb5rasxax
- SHA256 4ec412a6db30447e7e732517be24a93c4fc77278718b1f82f1854d6a2f6ad89e
- MD5 42e13acf3d013a65b8257ea3c6105fba
- SHA1 b767c086696244015389fca94654c0322e5becbe
- SHA512 dda397e007dc31d17d2d43a0adb979453b1198f333f26220edceb06d8c46ef2542db850d3b242cfa4632288c62287b4ad6aa5c7dd4631fb0377b2e901647ef81
- SSDEEP 24576:OEvtIEADAptGrZcJYZVj0J6VAfkMszNCxvvqhnpJ:OG6EupcMdzUxvK7
- TLSH T133353333E7345A5CA4D17830DC1A5C606EDA5C14E29BA467EEE67362A47DF7EA30F400
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/out/libvlc.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/out/libvlc.dll
File Explorer
-
out.zip.zip 1.1MB
-
out/libvlc.dll.dll 15KB
-
out/vlc741KB
-
out/vlc.exe.exe 943KB
out/libvlc.dll
- IMPHASH 9445186602569862063fdb73cf73782b
- SHA256 4b79e9865140e210afea6b2ad95e5d95760ce309dd41e02ea52e438f351679a8
- MD5 fca947d53208f48bc20d37e59fe794a7
- SHA1 1ede9f124cbe2fdbde0419692e8b63f58cf046a1
- SHA512 205631e33059a2f3665b6a04ca085a98b62ba7f062a92e875626c4bfaa457545ee686317ed95c24e27c3513ff2bc8d71cccb68f8598ae76fbd1ea5d731ba12d8
- SSDEEP 192:LwzRT6qvpmjzpf8WoKSgYQ/fEWFrZIy3y5+36:LwzRT6qhgfNoLc/OKy5+q
- TLSH T1BF62E789BB4194F3C1B78EB14DCBDFF69EA43A528443EAB1FB9ED20D78317026448449
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4592
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
api-ms-win-crt-heap-l1-1-0
calloc
free
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
libvlc_add_intf
libvlc_new
libvlc_playlist_play
libvlc_release
libvlc_set_app_id
libvlc_set_user_agent
libvlc_wait
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
604B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
140B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
236B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
468B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
out/vlc
- SHA256 782f999684f33104a22919440cb2327f4f3adffb7cd1a5dd4e8ff407e5864030
- MD5 dc72ec29bf7bd40c48100240d5e5094a
- SHA1 51e372f428e7ca53ee062eca09dab499a94bed16
- SHA512 a3b9782af454b4f7ff22ffe4ceddc2e80edab31df760abdc99044ec7ed70ae9a2fa20debdd0a47548db7d2eb110d68322e73f915944ff6704b16c2fd9300d326
- SSDEEP 12288:kVzOMQNTYJ9KdeJnmrWUu/AExzndWvycceAgQtGrZToDJYW6VjxGJ5YVA4UkMos8:UvtIEADAptGrZcJYZVj0J6VAfkMu
- TLSH T123F4236192105B5D94E1BC71EC3A7C702AEF5C15C20FE06ACFA6E3667939ABED70B404
- MD5 SHA1 SHA512 SSDEEP TLSH
out/vlc.exe
- IMPHASH e9911626e57ca2e368b85930484e29c0
- SHA256 2727f2739579932c4319feb3e484cb9be3b0e0d0ca36ab773ea19ead06c8db3a
- MD5 0f403fbfe09131e82cf5222bf6cd29c2
- SHA1 c24c9bd3e6f7ed82b8143bce59954bf81e91cc32
- SHA512 287ad20576b48e4f2639ebbae5b35a5dd31cf0cf6988793ffeb4ed3f759143a97059995c5537486869353ad2cc42f55cf24a24abc0a7c11825a0d8549f1269ff
- SSDEEP 24576:qJ5BOnKF/GBXXPj460HvjdF8rhaRUON0tITU5E:qhOnKuEPN0tZa
- TLSH T111255A66EA4384F0DE5705F1550BFBFBA9349F198020CD6FE288DE94FBB2C532469225
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
14:63:be:5f:24:68:80:95:53:17:86:44:32:8c:eb:79:3e:cb:e6:b6:a7:4a:0e:86:ef:46:07:e8:d5:aa:c0:4f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=VideoLAN,O=VideoLAN,L=Paris,C=FR
Chains
Oct 25, 2022
CN=VideoLAN,O=VideoLAN,L=Paris,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
8b:6e:52:9c:97:59:9b:98:36:e6:8e:ee:d4:13:aa:39:73:89:96:cc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=VideoLAN,O=VideoLAN,L=Paris,C=FR
Chains
Oct 25, 2022
CN=VideoLAN,O=VideoLAN,L=Paris,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=VideoLAN,O=VideoLAN,L=Paris,C=FR
Serial Number
04:07:ab:b6:4e:99:90:18:07:89:ea:cb:81:f5:f9:14
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 14, 2020 - Dec 18, 2023
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Minor OS version
0
Major OS version
4
Entry point
5312
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
libvlc
libvlc_add_intf
libvlc_new
libvlc_playlist_play
libvlc_release
libvlc_set_app_id
libvlc_set_user_agent
libvlc_wait
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegOpenKeyExW
RegQueryValueExW
kernel32
CloseHandle
CreateDirectoryW
CreateFileW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessId
GetStartupInfoA
GetSystemTimeAsFileTime
GetThreadContext
GetTickCount
HeapSetInformation
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
OpenThread
QueryPerformanceCounter
ReleaseSemaphore
ResetEvent
ResumeThread
RtlCaptureContext
SetErrorMode
SetEvent
SetLastError
SetNamedPipeHandleState
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WriteFile
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_exit
_fileno
_fmode
_fstat64
_initterm
_iob
_lock
_lseeki64
_onexit
_setmode
_snwprintf
fwprintf
_strnicmp
_unlock
calloc
exit
fclose
fflush
fopen
fprintf
fputc
fputs
fputwc
free
fwprintf
fwrite
getenv
isspace
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
raise
rand
realloc
setlocale
setvbuf
signal
sprintf
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strtoul
strxfrm
abort
towlower
towupper
vfprintf
wcscmp
wcscoll
wcscpy
wcsftime
wcslen
wcsncmp
wcstol
wcsxfrm
atoi
_write
_read
_putenv
_open
_fileno
_fdopen
_close
shell32
CommandLineToArgvW
SHGetFolderPathW
user32
MessageBoxW
wininet
HttpAddRequestHeadersW
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetCrackUrlW
InternetOpenW
InternetQueryDataAvailable
InternetReadFile
InternetSetOptionW
WinMain@16
Name
.text
Size
766KB
Virtual Size
766KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
53B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
69B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ