Script-Ware.zip
- SHA256 77e307748b17f05bf2740441346a34bf468281dcd6c12c315b619e1c787b0fea
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Script-Ware/Script-Ware.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Script-Ware/bin/Editor/monaco.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
Script-Ware/runtimes/win-x64/native/WebView2Loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Script-Ware.zip
- Size 3.8MB
- Sample260730-d3pr8abb82
- SHA256 77e307748b17f05bf2740441346a34bf468281dcd6c12c315b619e1c787b0fea
- MD5 5fd2fd029a9093477c091549866dba20
- SHA1 21cae6f871549907b45914eaf144ad9ecc7dbf0d
- SHA512 7bf9cef107d621a0051645251e8e3dfd231567e0bd7c4d61644cfebd9d7104e131bc703fae4a239e276ce89abf6929527704e222b49748eddd6a430b2dbe303b
- SSDEEP 98304:riQjuZ5eWBD3aOX+OVqryEcH7ya4DD0/P:rxjw5BBD3aOXLIrJcH7yTD4X
- TLSH T18D0633B25753025F8651CB3725CC1E0027EF3CDF822DAFB0A56B25A2D56581BDEC42E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/Script-Ware/Script-Ware.exe ConfuserEx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Script-Ware/Script-Ware.exe
File Explorer
-
Script-Ware.zip.zip 3.8MB
-
Script-Ware/Script-Ware.exe.exe 3.9MB
-
Script-Ware/bin/Editor/monaco.html.html .js 12KB
-
Script-Ware/runtimes/win-x64/native/WebView2Loader.dll.dll 156KB
Script-Ware/Script-Ware.exe
- SHA256 d8a79dbf8d8e569a5d0ac6aeb393ab9035d4d9965aa0418ea42cf9baec6436b0
- MD5 7327753f91d2e432949d4be8178a27c1
- SHA1 9fcc09d0c132c2da75f98019a90e27f08b663e0d
- SHA512 19ed8a78c92274b5f34394a1ba5744332f2cdb77ad9410bd3db17b88f5fb21f8fe03a4f4a52bea8d62b573738d22049860d6d71df69cb7a9472762ac471cae6d
- SSDEEP 49152:Y8MgIa5bOlziKeWu3IWuK2LYOf2Nx+LjBc/fHL5kOQs1LVcpObGQis4xIqDsInPF:Y8T5AilTH22x+6/2loccbvis49xOK
- TLSH T1D11633A2B351C01FC1508F370DD9DD8003EB3DAFE935A6A779193B8EBB721459C86266
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
227KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Script-Ware/bin/Editor/monaco.html
- SHA256 e6209cff1daa9b7c37367be88b8e4c7f615ddc18d97cb08e900851119088f410
- MD5 e0ca7786aab27fc1124c4e76c4626ae1
- SHA1 768ed7e7f140d3859498f6b605342ba96e4b8153
- SHA512 091825d98c1b2c2576701d4a1dfe08d5c9af4ad1c260bbb7d4b38dd930dca537af2e5901545350ac1d0c6fa69b40a426f3362918ac8d5682b68fdfbf444ff1d5
- SSDEEP 192:W4I1qcdODozAPX/heQmtqOFHO+yExOYQcYRBcIKQU20Bg:RI1Zk4RLIRxlk6
- TLSH T19252751BC301172AD137227AEF679218EB2220576600839D7AEC97721F726605EB1FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Script-Ware/runtimes/win-x64/native/WebView2Loader.dll
- IMPHASH 90db803f7a0acc2517ef287c1dc1bb76
- SHA256 ae69309c5e356350ea28d6b71a900bc43ee7e3f7a457d80a1f82efe6c419cc08
- MD5 7e36757d54d02eb93bfc13f8e81a79a1
- SHA1 48c5f26555d696ef0806d9d136dae28b5ea294de
- SHA512 a3fca3f610a652b63326d021ed1a8551d3fde7780371955a7232b239833e120de9046138f58df64fd07ef3a9c4762ed2d768640e1ee674ee2c0d143784c71386
- SSDEEP 3072:S8Jjy7/ph9euiDNQ6A93jJBC9JGv6TSMEtJ6mj4UrAmx:6/NVZ6A93j/QEtJnrb
- TLSH T19FF35C5BB2E500BBE17BC278C5A34A15E772B8111760AAEF036447791F13BD0AE3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a0:1b:22:f3:f8:f0:c1:ec:59:b0:2b:80:ec:83:8c:91:9c:0b:1b:dc:a4:79:bb:95:e4:da:1c:af:0a:5d:79:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 14, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7e:ac:fa:0a:41:ff:7e:13:f5:00:00:00:00:04:7e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:401A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:19:5e:b2:d8:54:75:f4:b1:8d:00:01:00:00:02:19
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Aug 14, 2025 - Nov 13, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
18608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ