HotmailSoftware_v20260626.6.zip
- SHA256 c4ed7aa29982e496200a80193ce74ba26183ad148ab377313ab7af5a6e4f2e6d
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HotmailSoftware_v2026.exe
Resource
win11-20260513-en
windows11-21h2-x64
32 signatures
600 seconds
Behavioral task
behavioral2
Sample
database/db_idtienphuoc.sqlite
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral3
Sample
database/db_idtienphuoc.sqlite-shm
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral4
Sample
settings/table_columns.json
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral5
Sample
version.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
600 seconds
General
- Target HotmailSoftware_v20260626.6.zip
- Size 88.7MB
- Sample260727-q4th1styby
- SHA256 c4ed7aa29982e496200a80193ce74ba26183ad148ab377313ab7af5a6e4f2e6d
- MD5 c32552c6898d98c8e8fc259253c4ee49
- SHA1 9ba6898005fb39bf1250d82992de7e5ddcdc8dc6
- SHA512 e0cad469b28cc99be74ce75a0365315badd269357532b72f81aac36c35bfabf5af48701822cf0ddd97dd2f0d27d9677be96ec5f3be269738368accc022087d4b
- SSDEEP 1572864:u2MleCZ60syugXH1g4ykexvUpXPRDxu788p0Rg9UQkkHphOeS3sTza:u2M0gVsolgV1QX5Dxc0RvepFLza
- TLSH T1791833E8D50C4A02BD963E51DEAD791F304E9F835D864EE41BBC7387239D213CA0DA5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/HotmailSoftware_v2026.exe unpack001/version.dll
File Explorer
-
HotmailSoftware_v20260626.6.zip.zip 88.7MB
-
HotmailSoftware_v2026.exe.exe 62.5MB
-
database/db_idtienphuoc.sqlite21.0MB
-
database/db_idtienphuoc.sqlite-shm32KB
-
settings/table_columns.json273B
-
version.dll.dll 19.2MB
HotmailSoftware_v2026.exe
- IMPHASH 98616d0f3ac3d3cbf38521d5f881421e
- SHA256 9961acb3c061db6a3da62cde734d30ef6c2cc156906bcfaacc91abf6cc52e1bd
- MD5 a623e6b6c4022a0474dfe92cc5deaffb
- SHA1 d1c18287886d0f2caed377e6bfe9cb9712afab98
- SHA512 ccb515762200d720cb14528e70d31be7f5aa078bbbedbb8912535a2019308af04d626a5ec1ecb7ade5a810ff06b3e21dce1840a68e06683b6738ada84d7d7480
- SSDEEP 1572864:TAsj4QHmgY6E4vPRMSIGShXwJRvbv3U5k4:TAssKhYyhMH9ERTv3u
- TLSH T170E733B4C6085553F9933D72D7DE711F325BDE424E460FD61AAC728A2B5C202CF0DAAA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
6
Entry point
14904
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\unknown\Desktop\work\Dropper\Setup.pdb
kernel32
IsDebuggerPresent
CloseHandle
SetUnhandledExceptionFilter
Sleep
ExitProcess
GetSystemInfo
GetTickCount
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryA
LoadLibraryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
WriteConsoleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
RegisterPathW
Name
.text
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
62.4MB
Virtual Size
62.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
database/db_idtienphuoc.sqlite
- SHA256 b78dda5c35ab2d7c6ca760dbae2f38561d586ff06a24c5dbb77c1af960f265da
- MD5 1a412cb0302561f3e18818e4659c5319
- SHA1 8771aaa01d13ab53ff88fb9701d92d2caaff4651
- SHA512 e86b72866682f5bb72a0b4d695c85e186934fde91e0b6d59b28914296d7422b0fa0ec8f996e7076c989c59c4bed6b604b953030ad42ec1576434e56551f9335a
- SSDEEP 49152:zxu3rzQUxqV14kkkpcQEpsPGlcKCjAwFz1QVwTQ9kcc+2jUyNbbzaaplWC1GxZyv:vf39e3di7
- TLSH T184279E73A13A365CFBFF5B7F48ADAD295C13291B7FF801B8C6D86C468812509A43E419
- MD5 SHA1 SHA512 SSDEEP TLSH
database/db_idtienphuoc.sqlite-shm
- SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
- MD5 b7c14ec6110fa820ca6b65f5aec85911
- SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
- SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
- SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
- MD5 SHA1 SHA512 SSDEEP
settings/table_columns.json
- SHA256 1b26988fb26c08f45d7f7b0c57152073de1bf2db730b6f3299595599c09ef6fc
- MD5 7c305055af5941aac787ec5a50abfc8f
- SHA1 92bd5028394b82ffd2240afc7b55d1623e849d02
- SHA512 810440bd94f5b59374b51f296c78297948f1ad4ab91f62a64dc8a536aeaae5201635060282a278ba5561c0f5e30244c3fa396f852d81d6708370df2e2db23f8e
- TLSH T1D7D02B42823EC93409F5A17368CCB8091EB3CE0C4AE9632CA9934209843FB2F30BB4C0
- MD5 SHA1 SHA512 TLSH
version.dll
- IMPHASH 9bc720d49ed501b15198f5b6109f5460
- SHA256 fc299c8c6f97e449a03f0eaf98514efb522523a74e50345c3e3fc4e553d8ff5f
- MD5 b1d5cb0c98f65703c48f5d3d9b22546c
- SHA1 f9276116e01f9fd5a1830c4217526161c23abe4f
- SHA512 0208c33f94a4ae072ec9a046e15c0c57faf99e3cde8d29f80becb4ab9607045cad729fed55dedd773da4f8c7b7edf14f7fa7b3a5225f980fe3f692c9fa33aa28
- SSDEEP 393216:UZIDNdsmLcFHoIuZdfb5XntCqPsmki/MNHiQGrrBYL9WY0nfv3gO:B3sGc9Z0BlgqPszMMFCrBI9WY4v3
- TLSH T1B61733C751DE57ACD2834788A98723C768C4646AD9EFCB2439C74C02B121D9986CBE7F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27354065
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualProtect
shell32
ShellExecuteA
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
_pf_GetFileVersionInfoA
_pf_GetFileVersionInfoByHandle
_pf_GetFileVersionInfoExA
_pf_GetFileVersionInfoExW
_pf_GetFileVersionInfoSizeA
_pf_GetFileVersionInfoSizeExA
_pf_GetFileVersionInfoSizeExW
_pf_GetFileVersionInfoSizeW
_pf_GetFileVersionInfoW
_pf_VerFindFileA
_pf_VerFindFileW
_pf_VerInstallFileA
_pf_VerInstallFileW
_pf_VerLanguageNameA
_pf_VerLanguageNameW
_pf_VerQueryValueA
_pf_VerQueryValueW
Name
.text
Size
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
./!J
Size
Virtual Size
12.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.Fy}
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.;Lb
Size
19.2MB
Virtual Size
19.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
459B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ