CH.zip
- SHA256 447d3c9d52b857ff2eebc0d277a461a8f85d27a7f980ae9d165cb2a116a8e3ec
Overview
overview
5Static
static
3cn (1)/lib/config.dll
windows10-2004-x64
1cn (1)/lib/config.dll
windows11-ltsc_2024-x64
1cn (1)/lib/core.dll
windows10-2004-x64
1cn (1)/lib/core.dll
windows11-ltsc_2024-x64
1cn (1)/lib...ty.dll
windows10-2004-x64
1cn (1)/lib...ty.dll
windows11-ltsc_2024-x64
1cn (1)/lib/ui.dll
windows10-2004-x64
1cn (1)/lib/ui.dll
windows11-ltsc_2024-x64
1cn (1)/run.vbs
windows10-2004-x64
5cn (1)/run.vbs
windows11-ltsc_2024-x64
5Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cn (1)/lib/config.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
cn (1)/lib/config.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
cn (1)/lib/core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
cn (1)/lib/core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
cn (1)/lib/integrity.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
cn (1)/lib/integrity.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
cn (1)/lib/ui.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
cn (1)/lib/ui.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
cn (1)/run.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
cn (1)/run.vbs
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target CH.zip
- Size 329KB
- Sample260802-plh4wsaa28
- SHA256 447d3c9d52b857ff2eebc0d277a461a8f85d27a7f980ae9d165cb2a116a8e3ec
- MD5 8231704733efa24004e381191448423f
- SHA1 463cb09c3c0b72a95fd2910a7eeb1015823c53e5
- SHA512 3cb0d39d4d713198f4ad102cfa0ce7871060a613b39f73d4fdf318d6ddce02b299b76753bf5df089c0d09f54228d51e0a22508c77b02d97118d63f4bbbb1dda7
- SSDEEP 6144:TYz/1Ik0e10KNlR9oVJse3UUP8lyI858tTDydDDl6tIG/LvJ4ERl6FSQx3d1B:C/1h5NBG8lytCZuKtIGTh4ERWFf
- TLSH T12D742370C94FF050EA3097B25B77EA7E441B334E5B9E488B5C747A48096A33C17A24ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/cn (1)/lib/config.dll unpack001/cn (1)/lib/core.dll unpack001/cn (1)/lib/integrity.dll unpack001/cn (1)/lib/ui.dll
File Explorer
-
CH.zip.zip 329KB
-
cn (1)/lib/config.dll.dll 108KB
-
cn (1)/lib/core.dll.dll 231KB
-
cn (1)/lib/integrity.dll.dll 15KB
-
cn (1)/lib/k.dat149B
-
cn (1)/lib/o.dat164B
-
cn (1)/lib/ui.dll.dll 850KB
-
cn (1)/run.vbs.vbs 11KB
cn (1)/lib/config.dll
- SHA256 713b58ac72fd6198f6bcf824298d7ac6aa1badcf0164d625887e360c9c619926
- MD5 7ae744713360cacecba886a0d6ebb401
- SHA1 c718cdbaf3024cdaac0a95036b766477b9e2984f
- SHA512 0d366e52ac2e2b40583ce694ffbaadf44e7af55104109360683331bc3cb0196b4952069edb0080be1b7be6640d089e0d3191bbdf049aaecd91daf84786723bd1
- SSDEEP 1536:DM3aUv9HOU0TDdKR11WzhvMoLThxAMDkz+2xlst1F/fBBUI:DM3aGPKcWzhvMQYMElCF/II
- TLSH T145B3D68163FC8A95E6FF6F32A9B486610A77FD1A68A7C71C094110AD0D32765DF2036F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
.\SafeExamBrowser.Configuration\obj\x64\Release\SafeExamBrowser.Configuration.pdb
Name
.text
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
cn (1)/lib/core.dll
- SHA256 2efeff372d855a2d60ad9f41798ac84ffb934e6621ae16194b307793bfb66c5a
- MD5 c3f0b69c60e7b9d0d0fb131535a3e5d7
- SHA1 fdf659b248ebf39e3865df857d69863446cdd501
- SHA512 2ba149a25cc8ceb9192450260dff9029627c04d043c213ac931a32dd6040c7e8df18d8ef98300509a43af994301e881909949d214b858393cf77bdd67cc277d4
- SSDEEP 3072:6+ECnr1SphRQtBzkBLe8wLbLq8zDKdpjz4N3HvTERuy4S6l2odbvvBLItN+mO0LC:ACnr1SBQtNwQsG
- TLSH T1CB34B6012BE48594F2FBBB75D97110214BB6BE0AA83DDF6D1484809D16F3718B896FB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
.\SafeExamBrowser.Browser\obj\x64\Release\SafeExamBrowser.Browser.pdb
Name
.text
Size
229KB
Virtual Size
229KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
cn (1)/lib/integrity.dll
- SHA256 37f63f5e036da5144e9c3649e5627c806573b09d00e01157d206a42d10b9eebe
- MD5 785a4e50114fdbdf330d9709304cdbeb
- SHA1 56b3d3fe46d76d74f602de4b3ab942d59409f9bc
- SHA512 5565b400ba9f51d1842b96ca0c56b529fb0a3e3168fbed7e103f50aa9751bd4731b85d941758285d0be201a0151c0d3b36593a2eb2792123fc89052c0dcfa473
- SSDEEP 192:pwSZmu3UPGHR3ogNbS8rbDLVc+NonQ8pWGoluvDmDTNuS98tU:okU+HpogplXHquonYG2uvDmQSSW
- TLSH T14062D645ABEC9216ECFF6B754AB152100BB1FF5298B6C70E19C920DF18637C08A25777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
.\SafeExamBrowser.Integrity\obj\x64\Release\SafeExamBrowser.Integrity.pdb
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
cn (1)/lib/k.dat
- SHA256 7595ca33a3b817dfccf4d9ee88fe8f2a77c54fd1b75aa2503128acfbfd9d7739
- MD5 d353469f91ac5fbbac19950bef47823e
- SHA1 7b3baf536b3cbaaa9d302d3e404cbe348fc1d917
- SHA512 02232747c56b0963efa9ae6038c65d32100da1351060f5c6a07300e752e9d22fbdcc100d1cb916c8907fba1a0e598c1bcbcd59e55eff0945876500518831cef3
- TLSH T159C08CAC992A1AC6B86E0887F269B928586590761187012EA14A08D0860003D26A2B38
- MD5 SHA1 SHA512 TLSH
cn (1)/lib/o.dat
- SHA256 c7391766861f9cc2bee6b74d8f3ed7e1382732f46009da1a6b91ae1f250e0499
- MD5 8a219d3066b51274302bf72d1aea0edf
- SHA1 121314bcff39b06bd84a8b5a31cc6ecd4f528b3d
- SHA512 bff38a0b2a83a01ba46764040e83569e643a44dea559a7369785dec97c8c1d8ddf290185bae6a4d3aac688ab896740b8bcf8d20979df9d8dc661a5c4f63ef0d1
- TLSH T17DC08CCB0280E46A91327459EAB0298A0438378A2BC309EB8845A6E1F940D2C292A421
- MD5 SHA1 SHA512 TLSH
cn (1)/lib/ui.dll
- SHA256 58e42c6fe09925b4b71531b5a95c366ea65f6ea944fb206f9366bf9636622c6f
- MD5 2afbbde1a4e77441fa456af9f9561f2c
- SHA1 2bc7f1a25d0abe0d26898c77fb7709c89dcf4cf6
- SHA512 f68001cc3cae0bb9cac70cf419a5793d487886056ba577113a7e81edd1d0f8434205273c88704ee1bbd915a882001466bcc147b5ff61d0c3ca5694ae4e277a5c
- SSDEEP 6144:/Bziqg15N0EzDKZTvnP5rjVsQt+OLsocREny4w+EQoVBQokS:/oqg15VDsTfhjVHt+OLsocREnfEPZ
- TLSH T11905D650EBED045DE4B178B5C831F0709726AD0A09A5898F69CD3C6F7A31F8A149BF27
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
.\SafeExamBrowser.UserInterface.Desktop\obj\x64\Release\SafeExamBrowser.UserInterface.Desktop.pdb
Name
.text
Size
848KB
Virtual Size
847KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
cn (1)/run.vbs
- SHA256 93488170abe378eb42d630389afda8655342f07add75b3103e30e814325f6401
- MD5 3c5389f557fdc960a8d9b2b219fce53c
- SHA1 1cc8859374f1232b6aa5cabf2e78a7e4f60dfb2c
- SHA512 a98735234674de79e4681d068759bd27c08ef553bb5c61cadec5a61aa78adfd0c4554d6adc5811509e2f6a2aab19ee3dfd4430fbe60c30e0ac291fe4ee63303d
- SSDEEP 192:GQKIH9/Oo7gj2tF/D/5M5SZeyhCZtmD1Z4hHz/71/O4a/yEH33/lV/cHnHs:YU5ZeQZ69I38s
- TLSH T149323203BA0A95AD21F043BE89AD586ACA544AEBCB613450359CC47D4F7A7FF81B05CE
- MD5 SHA1 SHA512 SSDEEP TLSH