a973b87b9648a9ba82b76ce6d2d45977f93864546d4fd137ef707ec0ab43a45f
- SHA256 a973b87b9648a9ba82b76ce6d2d45977f93864546d4fd137ef707ec0ab43a45f
Behavioral task
behavioral1
Sample
AntiSkidDLL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
AntiSkidDLL.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
RC7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
RC7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target a973b87b9648a9ba82b76ce6d2d45977f93864546d4fd137ef707ec0ab43a45f
- Size 3.6MB
- Sample260801-ry3eeabh78
- SHA256 a973b87b9648a9ba82b76ce6d2d45977f93864546d4fd137ef707ec0ab43a45f
- MD5 66aef8c2e1bcce13aa7bae2ebd4ec4f3
- SHA1 234be81b6b71c500b7deac8816ec04534e9491af
- SHA512 a973d4d74013d8d4b1b6e49212aa4cc6b9044c18aa663c2b085f6860bccda69aae12796a75f75a88745bca32c8856d8e0d3804e5f5ab8be6cb57527187fedef3
- SSDEEP 98304:KO+qfnV6abOnC9i1qVYY+FsgaO9EViFAwtyGmSBkTh:NnV1isVY3nEViAwIG3m
- TLSH T1840633C9D0E1FA46C2B0B0B183757ADE98EC5C0C073215EE7B669D74A72121DE0EB9D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/AntiSkidDLL.dll upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/AntiSkidDLL.dll unpack001/RC7.exe
File Explorer
-
a973b87b9648a9ba82b76ce6d2d45977f93864546d4fd137ef707ec0ab43a45f.zip 3.6MB
-
AntiSkidDLL.dll.dll 73KB
-
RC7.exe.exe 3.9MB
AntiSkidDLL.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8c382f17397517bda1ac66533c8c40c571e1ec078c84a4b2d397fa2f34bdd1c4
- MD5 87294aa0912182ec94f9341fbfa73a6c
- SHA1 d096a3a80b908c1ecff1816fe748cbea805fde9a
- SHA512 1524762c8733d794c9318c0dc2cd00d539392ec99eb869eb5d7dbb23566105f7bb849a6f896777da0293df0d5364cf67777433b9b90b79537fd049717d0fdb25
- SSDEEP 768:+BGTaoVw4YRTxTvYgAycaCWN1E8MSrEoW0VPQ7VPbXb9bnavnzHiz9H6xC:+BgaoVwZRTt9fd6TFbpafriz2C
- TLSH T12673C927653EABB0D2D665F143F04814CB23A0E352E2C90E4AB37DDF1851BE6592AD4F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
98314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
1E}
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
57KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
UPX
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RC7.exe
- SHA256 27db524e45cbdba4ef9be81e5520f9e02609eedc629751f89cd72d0b343c6c26
- MD5 645b94e9d5f3fbf970fd3fadaa9c81aa
- SHA1 1560403af14115227508e5d9d3a1747f8a92b7dd
- SHA512 ae6ffe1abd8c793a9d94305efbeae156b864344e8ff1ffb5b82ec2979338cca5a9b323878ec7bb7cd8e8757ab06d4fb1b47f318f9d5a673decea7e219203c810
- SSDEEP 98304:/1ARbTy2dO9CX8LS9Q8aTKeuq9qXyBqspyomAHkqi:/KbTt8u9QfTJqXUqs8oxg
- TLSH T17C1601E8F9C6D9C2C676B4F79830217C551E8DBDAB16030322B07E78257229BCE5D58E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
TveUB
Size
833KB
Virtual Size
832KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
\ h \H4+
Size
940KB
Virtual Size
940KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.F14CDDE
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_MEM_EXECUTE
Name
.C496006
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ