296_2556_super_simp.rar
- SHA256 bf1532618013b2152ae270985d9362aec691045be72d3085cb05e9c86a43e23d
Behavioral task
behavioral1
Sample
super simple wallhak/SSWHv7.0/SSWv7.0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
super simple wallhak/SSWHv7.0/SSWv7.0.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
super simple wallhak/SSWHv7.0/SSWv7.0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 296_2556_super_simp.rar
- Size 134KB
- Sample260728-w6f9csbc22
- SHA256 bf1532618013b2152ae270985d9362aec691045be72d3085cb05e9c86a43e23d
- MD5 4562c4a203798c22f877b7f91e5edb5e
- SHA1 53bc236a5e7d54997fe3e8c538f4462438c1810e
- SHA512 cb17dd3a5650beca4fcda8aa3f426ec49bbc153a86616560286737bc88aea9ccc5fb17a3eeeb34778256b34b4633c8a9141bbd4e501987ef2802e51902b54b6b
- SSDEEP 3072:0Z4kBvXCcFN5Wv2IUfI0ZnXtaYDcA2SYPrcTHX50GsjvA10/YnLn4MmDjRMx:DevXCcBE2RfL9X2SYYLZszA1JnS8
- TLSH T185D3128C8440A11C1ED9F18C0B55A6AD0415AB62816FF3D63B71FF286E4A697CE43F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/super simple wallhak/SSWHv7.0/SSWv7.0.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/super simple wallhak/SSWHv7.0/SSWv7.0.dll unpack001/super simple wallhak/SSWHv7.0/SSWv7.0.exe unpack002/out.upx
File Explorer
-
296_2556_super_simp.rar.rar 134KB
-
super simple wallhak/SSWHv7.0/ReadMe.txt1KB
-
super simple wallhak/SSWHv7.0/SSWv7.0.dll.dll 24KB
-
super simple wallhak/SSWHv7.0/SSWv7.0.exe.exe 137KB
-
out.upx.exe 160KB
super simple wallhak/SSWHv7.0/ReadMe.txt
- SHA256 469639cfc1cd984047eec3c26f257e2c9801ffde53a2255cc32207607123956d
- MD5 605647a5442b5b4f668bdbefb6c8ea2c
- SHA1 7981dcb8dce8d35e5f1936876e0a63fbc9543fe8
- SHA512 5af333a78b188dea2d7a0116f7c766e73a8ddc4b2bc87b0e88ef4362ef34da386a4daa15be78e33ae1e30f31c5a9012a0885d58ef2250e9c9f0fab5e03a933b7
- TLSH T12D3153CDFC12C9379933C0EAA411355AFF44949ED3264596361B046D337509B827E7BE
- MD5 SHA1 SHA512 TLSH
super simple wallhak/SSWHv7.0/SSWv7.0.dll
- IMPHASH ee27924dc7fe8c78f4626d3fae5842aa
- SHA256 5dc038d93192a15d38e1e5fd0ec475ad982d101bc33f2ba2aac960ac2d31e29c
- MD5 d1af8291df8c729bd2c51961c2e5c373
- SHA1 7e14e7d97967ac4e4a0d470e65844f024829d272
- SHA512 61849c07d0eec845efaa007a7464964256a6bfde1e887f3db60d33ccb9a2d90b91dacb5bbb687ce1c02fbe6ad9d0dbf49fbd643f11fe5fd9b1cd1d537e7d75af
- SSDEEP 96:IeKd7z7zFFxGmxneGl6ZBzwlt0PVMHh69vhU4U0IaJ29/oON2xiUmfczplLDlrju:+/Fpxnr6ZRYyE6pW4V22xizkzRXBb
- TLSH T153B2A557C3452BF3C392927609CBE2699C7BAE31265412C22FA63F4D1DBA3507DE910A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10551
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
VirtualProtect
user32
GetAsyncKeyState
GetSystemMetrics
opengl32
glClear
glLineWidth
glEnd
glClearColor
glPolygonOffset
glVertex2f
glVertex3fv
glViewport
glColor4f
glBlendFunc
glVertex2i
glGetFloatv
glTexEnvi
glDepthRange
glBegin
glEnable
glDisable
glColor4ub
msvcrt
_adjust_fdiv
_initterm
free
strcmp
time
srand
rand
malloc
memcpy
memset
Name
.text
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
538B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=34, id=1, productName=Unmarked objects,
count=7, id=19, version=8034,
count=2, id=22, version=8168,
super simple wallhak/SSWHv7.0/SSWv7.0.exe
- SHA256 1335d1f1f9d9892ef912fd4a64355f1ff278ed33f4511674c55ba4bf64e4406a
- MD5 58680bc18125ce12fd894a88bc48df9a
- SHA1 56463646cb9a72babf6c8b130147465209f5c282
- SHA512 33b88831e0ed9456b193b1679c666cbecbb225557fe7cca09f62c30f12f089cb3c14c6ed6a1a92f1e7cc64a9ed639a9397cae71f2d8e10ddc40344da87b45fb1
- SSDEEP 3072:8NsIsEvs/saUeMjKzxvyK9oCMoMU0upSnGGUvjwsQiaFs:DIBv1jXezxvsorJ3s3iis
- TLSH T17AD30292E262488DD0B31B3467AB9970420ADEF157E5C1D338672DD588F3FB25E86690
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
170816
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
127KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=25, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=10, id=14, version=7299,
count=5, id=19, version=8034,
count=55, id=1, productName=Unmarked objects,
count=1, id=22, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
out.upx
- SHA256 dc45bf7237ebf7a7a43776f85c56e60630083f8f9e8063dd4a5de751f9e9c76d
- MD5 48a91e8f58aeb747e88cdde888e4b4ee
- SHA1 c9ff43ce24f3140614764a8f1628aa1c81cf8e6e
- SHA512 516f984259c8e966a11c9073a6f8892abc700bc6c910a5cc7a2062dcfd4dbed35996fa6cfece47b9c70c342f9e5d1b6411beacf4f1b39756d33c5ef58b245da5
- SSDEEP 3072:lIi/5/WjuvW2LJPFDUf5zT7mdG7mkbAL9b:lp5/luMJtDU5yqAB
- TLSH T10CF3E023D9D1865BC87A077437756B08072FAFA17DFCA947BF657480ABB32F26816041
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6260
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
132KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=25, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=10, id=14, version=7299,
count=5, id=19, version=8034,
count=55, id=1, productName=Unmarked objects,
count=1, id=22, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,