VATN0.20260730201652_NBw5w.tar.gz
- SHA256 eab1ea37f8be28a8181743c9b6004dd144b5c00f12f70a5c5dd9428b84fe6449
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VATN0.20260730201652.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
VATN0.20260730201652.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target VATN0.20260730201652_NBw5w.tar.gz
- Size 11.3MB
- Sample260730-ev5zxabe82
- SHA256 eab1ea37f8be28a8181743c9b6004dd144b5c00f12f70a5c5dd9428b84fe6449
- MD5 385b7a095640a5f1f6db71bde0e9eaea
- SHA1 d3aca152f133debf161cf2fb4c3c2599b78915ca
- SHA512 0b6edf6c27c778573a1be78db4cfe9b25a84e3da113de22f7bd77b4632800ff8259e64f230724bc40a6df8b65888b9d8e7245a85d79a1d3997d62f08175a9287
- SSDEEP 196608:fd1JwAGqgF30HE9kPCovjfWTNQTBJJhBwJ6jsLmmgYEW5N2wa1f0w0DeNkSv8/LV:fdfwAPkQC4WTNQFdsLmvYr5N2wON0CNw
- TLSH T111C633AC6D93C85BAB1D69F338634631C773D1FCAADE2033196A92B26FB319527415C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/VATN0.20260730201652.exe
File Explorer
-
VATN0.20260730201652_NBw5w.tar.gz.gz 11.3MB
-
VATN0.20260730201652_NBw5w.tar.tar 11.8MB
-
VATN0.20260730201652.exe.exe 11.8MB
-
whatsapp_backup.pyc15KB
VATN0.20260730201652_NBw5w.tar
- SHA256 a5e475d133d662affe0fcf74f8edf93b7c34849ad58ce9b1f392c0af46b6ad2a
- MD5 0e8f5462635457e6a5e1036fa86bb434
- SHA1 f231fea36de28c8571446034c80db8a4a5a1b991
- SHA512 484b6ad9dd67d5dcd393478d065e3366bb2c751894caa855727d7e299bb886262aa24cf94568c2b16c8647bcddf9f6360c7d82c21aece0c742db39b104fcc9a4
- SSDEEP 196608:V5b/mq6Ls/03WZbk1IDLN3YD9oamvdsCnc7gomn9VHGDsS0BeRSsD2Wj0:V5zmq64MWZgWDCDivaCnc7H07mABQSsb
- TLSH T139C6019286400C23F885BBB18B4E46758F2A8EEB75D4FF4188A0BDDD763618E15F2717
- MD5 SHA1 SHA512 SSDEEP TLSH
VATN0.20260730201652.exe
- SHA256 276fc01a7042caedac6bafe5f5aabe2ab9e242a1f1695a67acedc3c1936a2afd
- MD5 98a1b2fa0ac86b70aeed1c74ec9d0f10
- SHA1 3e0595430fe7da7c658e71b7749408b09b45f0f8
- SHA512 4976534160b065a6874b09c2a6277977ae9a042bed6ad2d05e96430c1245fd97116ba6e54c9e2dda6836f49ce9082c4dfd79a61724985bdf65d51a92e12ee690
- SSDEEP 196608:V5b/mq6Ls/03WZbk1IDLN3YD9oamvdsCnc7gomn9VHGDsS0BeRSsD2Wj0:V5zmq64MWZgWDCDivaCnc7H07mABQSsb
- TLSH T172C6019286400C23F885BBB18B4E46758F2A8EEB75D4FF4188A0BDDD763618E15F2717
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8991072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
94KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
39KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
62KB
Virtual Size
534KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
535KB
Virtual Size
535KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.winlice
Size
Virtual Size
7.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
whatsapp_backup.pyc
- SHA256 a611e837765249da78f2d4b4d11ee16861d740ad2e8570ac9d154418cb3ac6c3
- MD5 853d2b44e6360c00305be63eba8b7491
- SHA1 6a2d98d7e285182485165f7620f8035fdaa1fdb1
- SHA512 9493310817eea6b9ae6c31656a075c24ac6bad4521c8cbb8440f7f83041b8af339fedc10e2642199ecef143ac2181871c33d983c7861b622c58e27f1d8be5adb
- SSDEEP 384:2tIMDwH+g4nInzlubzZHm2YYV/Aps6QaZDktE/PVBvH92zgoCfB9O7A+sgGR3D96:FqwH+znwMVtCkqtF92eB5+fa96H
- TLSH T1D1624BAFA2059D55F8E8F2F920DA078F0AFAFB4DC63155519412E0A9DCD03EC29B429D
- MD5 SHA1 SHA512 SSDEEP TLSH