RadLLM.zip
- SHA256 7372d0822903fe4dc461f9efcc1422f169d7c983f3cd2b715b4a223acfa993ef
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AutoHotkeyU64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
AutoHotkeyU64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
啟動RadLLM.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
啟動RadLLM.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target RadLLM.zip
- Size 659KB
- Sample260802-rhdfca1tby
- SHA256 7372d0822903fe4dc461f9efcc1422f169d7c983f3cd2b715b4a223acfa993ef
- MD5 f9b53822c988939444560056e95f6635
- SHA1 0b0b46cdc5ea942be7e3f4ea6eb65a152d85747d
- SHA512 6916b52aaa4cd82689f697ec4d84116eb699d69d33a63e5ce03ba5eb02516ad88ddf50d0a92944ff724778dfcf6a4349f9ae902eaa830f567c508433797150bb
- SSDEEP 12288:8DLlFx7aDEcYz37eA7ybydadxMfIGEYyQ8TMuVyWfh0rkLkjrykcom:QZCEcYL7euNadxUIX5Qkjh0oLErlc3
- TLSH T1C1E423DB96025F6B367A091C6FA92C0C27336F842EC4EA3D9282E7CAF94F39D5711514
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AutoHotkeyU64.exe
File Explorer
-
RadLLM.zip.zip 659KB
-
AutoHotkeyU64.exe.exe 1.3MB
-
README使用說明.md4KB
-
RadLLMTool.ahk42KB
-
啟動RadLLM.bat70B
AutoHotkeyU64.exe
- IMPHASH a9b5160326ed68a4bb81944dabab7ed6
- SHA256 effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
- MD5 2d0600fe2b1b3bdc45d833ca32a37fdb
- SHA1 e9a7411bfef54050de3b485833556f84cabd6e41
- SHA512 9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703
- SSDEEP 24576:a3CTQQje6KWjFUsTNEDcN20pah5nQsrivkdhWeWr2O8hYzlj1TNp4j7YoqK:a3CTQQjxKWjFUsTWDcN20k5nQsrivkdq
- TLSH T196559D0633E6C0E8DEB391F6C5299623D772781407389BDB25E0592DDFA3AE05B3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
895140
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wsock32
getservbyport
ntohs
inet_addr
htonl
getservbyname
WSASetLastError
htons
WSAGetLastError
gethostbyname
ioctlsocket
gethostbyaddr
gethostname
shutdown
WSACleanup
closesocket
connect
socket
WSAStartup
send
recv
WSAAsyncSelect
inet_ntoa
winmm
waveOutGetVolume
mixerGetLineInfoW
mixerSetControlDetails
mixerGetControlDetailsW
mixerGetLineControlsW
mixerGetDevCapsW
waveOutSetVolume
mixerClose
mixerOpen
mciSendStringW
joyGetDevCapsW
joyGetPosEx
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
comctl32
ImageList_GetIconSize
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
ImageList_ReplaceIcon
CreateStatusWindowW
psapi
GetModuleBaseNameW
GetProcessImageFileNameW
GetModuleFileNameExW
wininet
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetReadFileExA
InternetOpenW
kernel32
GlobalFree
GlobalUnlock
WideCharToMultiByte
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetEnvironmentVariableW
lstrcmpiW
GetStringTypeExW
CreateThread
SetThreadPriority
GetExitCodeThread
CloseHandle
CreateMutexW
GetLastError
LoadLibraryW
GetModuleHandleW
GetVersionExW
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
GetFileAttributesW
GetFullPathNameW
GetSystemTimeAsFileTime
LoadResource
LockResource
SizeofResource
GetShortPathNameW
FindFirstFileW
FindNextFileW
FindClose
FileTimeToLocalFileTime
SetEnvironmentVariableW
Beep
MoveFileW
OutputDebugStringW
CreateProcessW
MultiByteToWideChar
GetExitCodeProcess
WriteProcessMemory
ReadProcessMemory
GetCurrentProcessId
OpenProcess
TerminateProcess
SetPriorityClass
SetLastError
GlobalAlloc
GetDateFormatW
GetTimeFormatW
GetDiskFreeSpaceExW
SetVolumeLabelW
CreateFileW
DeviceIoControl
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceW
GetCurrentDirectoryW
CreateDirectoryW
ReadFile
WriteFile
DeleteFileW
CopyFileW
SetFileAttributesW
LocalFileTimeToFileTime
SetFileTime
GetFileSizeEx
GetSystemTime
GetSystemDefaultUILanguage
GetComputerNameW
GetSystemWindowsDirectoryW
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
VirtualProtect
QueryDosDeviceW
CompareStringW
RemoveDirectoryW
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FormatMessageW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
WritePrivateProfileSectionW
SetEndOfFile
GetACP
GetFileType
GetStdHandle
SetFilePointerEx
SystemTimeToFileTime
FileTimeToSystemTime
GetFileSize
IsWow64Process
VirtualAllocEx
VirtualFreeEx
EnumResourceNamesW
LoadLibraryExW
GlobalSize
GlobalLock
FindResourceW
SetErrorMode
GetCPInfo
SetCurrentDirectoryW
Sleep
GetTickCount
MulDiv
EncodePointer
HeapSize
HeapQueryInformation
GetCommandLineW
GetStartupInfoW
GetOEMCP
IsValidCodePage
FlsGetValue
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
DecodePointer
FlsSetValue
FlsFree
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
HeapSetInformation
GetVersion
HeapCreate
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
RaiseException
RtlPcToFileHeader
LCMapStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
SetFilePointer
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetLocalTime
GetProcessHeap
user32
SetWindowPos
SetLayeredWindowAttributes
InvalidateRect
EnableWindow
GetWindowTextLengthW
EnumWindows
IsZoomed
IsIconic
EnumDisplayMonitors
RegisterWindowMessageW
GetSysColor
GetSysColorBrush
DrawIconEx
FillRect
DefWindowProcW
SetForegroundWindow
DialogBoxParamW
SendDlgItemMessageW
GetDlgItem
SetDlgItemTextW
MessageBeep
GetCursorInfo
GetLastInputInfo
GetSystemMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringW
ExitWindowsEx
SetMenu
FlashWindow
GetPropW
SetPropW
RemovePropW
MapWindowPoints
RedrawWindow
SetWindowLongPtrW
SetParent
GetClassInfoExW
DefDlgProcW
GetAncestor
UpdateWindow
GetMessagePos
GetClassLongPtrW
CallWindowProcW
CheckRadioButton
IntersectRect
GetUpdateRect
PtInRect
CreateDialogIndirectParamW
GetWindowLongPtrW
CreateAcceleratorTableW
DestroyAcceleratorTable
InsertMenuItemW
SetMenuDefaultItem
RemoveMenu
SetMenuItemInfoW
IsMenu
GetMenuItemInfoW
CreateMenu
CreatePopupMenu
SetMenuInfo
AppendMenuW
DestroyMenu
TrackPopupMenuEx
CopyImage
SetWindowRgn
CreateIconFromResourceEx
EnumClipboardFormats
GetWindow
BringWindowToTop
GetTopWindow
GetQueueStatus
CheckMenuItem
PostQuitMessage
GetIconInfo
ChangeClipboardChain
SetClipboardViewer
LoadAcceleratorsW
EnableMenuItem
GetMenu
CreateWindowExW
RegisterClassExW
LoadCursorW
DestroyIcon
DestroyWindow
IsCharAlphaW
MapVirtualKeyW
VkKeyScanExW
MapVirtualKeyExW
GetKeyboardLayoutNameW
ActivateKeyboardLayout
GetGUIThreadInfo
GetWindowTextW
mouse_event
WindowFromPoint
GetSystemMetrics
keybd_event
SetKeyboardState
GetKeyboardState
GetCursorPos
GetAsyncKeyState
AttachThreadInput
UnregisterHotKey
RegisterHotKey
SendMessageTimeoutW
UnhookWindowsHookEx
SetWindowsHookExW
PostThreadMessageW
IsCharAlphaNumericW
IsCharUpperW
IsCharLowerW
ToUnicodeEx
GetKeyboardLayout
CallNextHookEx
CharLowerW
ReleaseDC
GetDC
MessageBoxW
OpenClipboard
GetClipboardData
GetClipboardFormatNameW
CloseClipboard
SetClipboardData
EmptyClipboard
PostMessageW
FindWindowW
EndDialog
IsWindow
DispatchMessageW
TranslateMessage
ShowWindow
SetFocus
SetActiveWindow
ClientToScreen
EnumChildWindows
MoveWindow
GetWindowRect
GetMonitorInfoW
MonitorFromPoint
GetClientRect
SystemParametersInfoW
AdjustWindowRectEx
DrawTextW
CreateIconIndirect
SetRect
CountClipboardFormats
SetWindowLongW
ScreenToClient
IsDialogMessageW
SendMessageW
IsWindowEnabled
GetWindowLongW
GetKeyState
TranslateAcceleratorW
KillTimer
PeekMessageW
GetFocus
GetClassNameW
GetWindowThreadProcessId
GetForegroundWindow
GetMessageW
SetTimer
GetParent
GetDlgCtrlID
CharUpperW
IsClipboardFormatAvailable
SetWindowTextW
IsWindowVisible
LoadImageW
BlockInput
SendInput
gdi32
GdiFlush
CreateDIBSection
EnumFontFamiliesExW
SetBrushOrgEx
SetBkColor
GetPixel
BitBlt
CreatePatternBrush
SetBkMode
GetCharABCWidthsW
GetClipBox
FillRgn
GetClipRgn
ExcludeClipRect
GetDeviceCaps
DeleteObject
CreateFontW
CreateSolidBrush
CreateDCW
CreateCompatibleBitmap
GetSystemPaletteEntries
GetDIBits
CreateCompatibleDC
CreatePolygonRgn
CreateRectRgn
CreateRoundRectRgn
CreateEllipticRgn
DeleteDC
GetObjectW
GetTextMetricsW
GetTextFaceW
SelectObject
GetStockObject
SetTextColor
comdlg32
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
advapi32
GetUserNameW
LockServiceDatabase
OpenSCManagerW
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CloseServiceHandle
RegConnectRegistryW
UnlockServiceDatabase
shell32
DragQueryPoint
SHEmptyRecycleBinW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
ShellExecuteExW
Shell_NotifyIconW
DragFinish
DragQueryFileW
ExtractIconW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
CoInitialize
CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoGetObject
StringFromGUID2
CreateStreamOnHGlobal
oleaut32
OleLoadPicture
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnlock
SafeArrayDestroy
GetActiveObject
SysStringLen
SysFreeString
SafeArrayCreate
VariantClear
VariantChangeType
SysAllocString
SafeArrayCopy
VariantCopyInd
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SafeArrayLock
SafeArrayPtrOfIndex
Name
.text
Size
948KB
Virtual Size
947KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
210KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
Name
data
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=152, version=20115,
count=54, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=151, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=486, id=1, productName=Unmarked objects,
count=23, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=43, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
README使用說明.md
- SHA256 0d6571c9fc6fb5058b539bc67fa1f964107f6e402bd9abe0740a0aa6dbb1d153
- MD5 ed166768f6ad0bdb4d4c703f46eb4bce
- SHA1 2eaaa28c3ac971773216f490b4fc8a59aac53fc2
- SHA512 b6db5ba443b8b8a80f45298d0081027d5c29cfe9c5e791a2cad04197fb7b98752d874c0b298d10a3e493bdd2ec6f88e082a9dfb063dc780f2189f4c7e30f2b1c
- SSDEEP 96:unydSoxrO6BCzliTtV2b52gW6CTG0ZfZ3fy112lVwpXCB5NU6cHYTCP:ciSoxC6vTtEl/W68x4gspyRKP
- TLSH T108B11825494A2DFC0D223AC5B3C6610AC5DC2A676C33E324DD1EEE8EBFCC7944A064C0
- MD5 SHA1 SHA512 SSDEEP TLSH
RadLLMTool.ahk
- SHA256 8db54261f1b4cd8c19d7b686c7a659c78c067f1ad1c5d33234181fef78d1eaa3
- MD5 477cadc7a538eda6bd7c93f284fc5f56
- SHA1 ae9bdf9443513c12053b4f7412b785e94fb858eb
- SHA512 0ad8e4ca919f54403d2fbd525a25cac3e9dfb176d50d22c510a750e95dbdeea31192996d41762ef50a6aa506340c17dd9e51cb5c52a9bda5d4c7bda49e83b21a
- SSDEEP 768:WvEKoRE31N/dxWHcyMaTUB4bZhazVVM01hgr02hV57sJ7h05N/OgM1:WjI2z/dLyMuU2na5DMNh4rcN/OgM1
- TLSH T1561309AA6DC27E940B06F2A87A85411FF6549843A1D95B30FE1F82CC3F9473593F8AD4
- MD5 SHA1 SHA512 SSDEEP TLSH
啟動RadLLM.bat
- SHA256 bee8431eda66d8c027ca2bff3d47b84f34b746bf2b2b64970969a3f711dd9e72
- MD5 01129a827ca21afd09f8c64d1b86fc5c
- SHA1 250c50a6ea7d310be09b35d1cd12f6d677719f61
- SHA512 179d6a31ff490e2060a3e045b1e2e378a16803f114890ead7fea09be900556c9cb022eb646b64a2360737f5001871f7e4f78aaedef1fb1d98813e63bfa060df2
- TLSH T1D7A0020155075C5E6A87491450C62943B40F84EB688885D0F5155CB48C9FB45B9CD585
- MD5 SHA1 SHA512 TLSH