AspasSetting By Def&Zen.rar
- SHA256 d889e0c12088087df3534aeac5bfce5a8dcb4d9aab1f836070901465f3a6a83b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AspasSetting By Def&Zen.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
AspasSetting By Def&Zen/Aspas Setting.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target AspasSetting By Def&Zen.rar
- Size 3.1MB
- Sample260727-pyachsszas
- SHA256 d889e0c12088087df3534aeac5bfce5a8dcb4d9aab1f836070901465f3a6a83b
- MD5 3d613516af0a32f4bc0ea98dcf9728a6
- SHA1 4ea1fdd19079ee56126fc0cc7ef7fb717af10e8d
- SHA512 f49192f6119f219ab985b1de29fb94b2d30b4b79ba5b0d2be1888f7cf09c8e3e73fca7dd65cc01f304ccd93202ceb0a3f0eec8f0609f91cd2db4b8892dd2f57c
- SSDEEP 98304:L8Py6ajxgi25/F+vxUOPkAeLdosZ0ikbToiiB3np70r:MyRKi2kn7eqsCi4ToiiB3G
- TLSH T148E5332736A2FE34E427DB7D6B7C8691ED10B24BCEE2C151371EE0B1985DE867204639
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AspasSetting By Def&Zen/Aspas Setting.EXE
File Explorer
-
AspasSetting By Def&Zen.rar.rar 3.1MB
-
AspasSetting By Def&Zen/Aspas Setting.EXE.exe 4.1MB
AspasSetting By Def&Zen/Aspas Setting.EXE
- IMPHASH 073cb217b20a432e4b4592909a8851b3
- SHA256 a5c0dca0d097efa62ba39b144a6a85352296babded76040ebaab76e255a9a451
- MD5 a33f1ebbadff20e336cbd8b80909c7eb
- SHA1 322ba73e5a2c01052d755ebb93f0cc9ac5830b2b
- SHA512 3ceb567efca0237e5d094a3f552019928f3876013025c00f911ad758bbd68fc9730bdab082fc5f7096efcab45802f9a7fc7c843f77dd14d6b929705266299394
- SSDEEP 49152:lqmfEfcnrzuBUgDJYk5SUYvJjwwwyiE5oqrHLJO1qRL+X4LA5Z/h92e9G6svtc55:lEforzwUI5o9NniEoqDL412gF2eQP1I
- TLSH T12616E1A2D9C0E15CC663C1704D1B71019629B6FF27F8B1CABADE442DAF61B41CD27B29
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
212828
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
OpenProcessToken
AdjustTokenPrivileges
GetTokenInformation
LookupPrivilegeValueA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
RegGetValueW
user32
SetFocus
LoadIconW
LoadCursorA
EnumWindows
FindWindowW
ScreenToClient
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageA
PostMessageW
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
SetWindowPos
MessageBoxW
IsWindowVisible
keybd_event
ReleaseCapture
SetTimer
KillTimer
GetSystemMetrics
UpdateWindow
SetForegroundWindow
BeginPaint
EndPaint
InvalidateRect
GetWindowTextW
GetClientRect
shell32
ShellExecuteExW
SHEmptyRecycleBinW
ShellExecuteW
ole32
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
gdi32
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SelectObject
dwmapi
DwmSetWindowAttribute
urlmon
URLDownloadToFileW
gdiplus
GdipDeletePath
GdipAlloc
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipFree
GdiplusStartup
GdipCreatePath
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipAddPathEllipseI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateLineBrush
GdipCreatePen1
GdipDeletePen
GdipSetPenStartCap
GdipSetPenEndCap
GdipLoadImageFromStream
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipDrawLine
GdipDrawRectangleI
GdipDrawEllipseI
GdipFillRectangleI
GdipFillEllipseI
GdipDrawImageRectI
GdipSetClipPath
GdipResetClip
GdipCreateFontFamilyFromName
GdiplusShutdown
winhttp
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
kernel32
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
GetCommandLineW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize
SetEndOfFile
WriteConsoleW
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
RaiseException
RtlPcToFileHeader
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
WakeAllConditionVariable
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
SleepConditionVariableSRW
GetStdHandle
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileSize
ReadFile
WriteFile
GetTempPathW
IsDebuggerPresent
DebugBreak
OutputDebugStringW
CloseHandle
SetHandleInformation
GetLastError
SetLastError
CreatePipe
HeapAlloc
HeapFree
GetProcessHeap
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexW
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
Sleep
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
GetCurrentThread
GetCurrentThreadId
CreateProcessW
OpenProcess
GetSystemTimes
GlobalMemoryStatusEx
GetSystemDirectoryW
FreeLibrary
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetConsoleWindow
K32EmptyWorkingSet
K32GetProcessMemoryInfo
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OutputDebugStringA
LoadLibraryExW
QueryPerformanceCounter
QueryPerformanceFrequency
LocalFree
FormatMessageA
GetLocaleInfoEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RtlUnwind
Name
.text
Size
370KB
Virtual Size
370KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
143KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=187, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=17, id=260, version=35207,
count=96, id=261, version=35207,
count=21, id=257, version=33145,
count=307, id=1, productName=Unmarked objects,
count=6, productName=Unmarked objects (old),
count=1, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,