dollama-windows-amd64.zip
- SHA256 1a15d4438d7382f549cb6c6bcd8091d7f281b6c08f3e5286cc8dbbbc30bb9b5a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dollama.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
dollama.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target dollama-windows-amd64.zip
- Size 9.1MB
- Sample260730-evfd9acp4w
- SHA256 1a15d4438d7382f549cb6c6bcd8091d7f281b6c08f3e5286cc8dbbbc30bb9b5a
- MD5 87ad8c7d9b02f0f94bc47fd152eab2a5
- SHA1 5edfed544cdbcde140496c650bda9a003721fde6
- SHA512 60a73563a8466bf562b70f7517e32cd063331e8b15aa541b712668e15c5bfddd3e5036c4cb87e98061627757d1552d94642a8caa6e039ef412a279a6c675c2e3
- SSDEEP 196608:tTeLgorF34aQTHV1He0r/SabfBm5Gd1UK7n4pgqWehv:taLV4VHV1HnbBmgdtUpgqThv
- TLSH T14DA633C482FA17D190ECD65D7D6202711A78A877ACFBED54C5CDB38306782EF2A170A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dollama.exe
File Explorer
-
dollama-windows-amd64.zip.zip 9.1MB
-
dollama.exe.exe 24.1MB
dollama.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 b3114b264f61e4c1daeac0baa3a9b61e77bb8135c580465abd2405019697df45
- MD5 7555aa7ca2ef89a8d643db6226f33935
- SHA1 e5f76ece7e58f64170b24300c424f436a4701a3a
- SHA512 a380feb0e67f90a7fdff1c28f8e84f5f700a0afa4cc8222db810c2e00965aac82faf2e35f1fc3906c492a9a927a9cb3a20036341118a0e8a3c527220af72ed66
- SSDEEP 196608:KNbE8dtXOOUmwixkAuuzLPMUELE0Pl7SH+rMPggv:KNjdZOO1sFLE0Pl7yg
- TLSH T120474A03E96544E5C0AAD234C6769213FB71B84A473023D73FACB6682F76BE09E79744
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
532192
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
9.4MB
Virtual Size
9.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12.3MB
Virtual Size
12.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.9MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
197KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ