acidhead.zip
- SHA256 7d134d26a71b932ecee3ff71285e657bc648ec90bd1d39b7b2f8f84141fd84ef
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acidhead/cilent.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
acidhead/server.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target acidhead.zip
- Size 36KB
- Sample260803-sbm7msdr61
- SHA256 7d134d26a71b932ecee3ff71285e657bc648ec90bd1d39b7b2f8f84141fd84ef
- MD5 62c2c9dad508cd2b351ac3eee103a3a1
- SHA1 641d2f4ba3f2a34ff39c3d22e7380d21255339f5
- SHA512 142b6e00e084c3a622aa918354cf15ec83d885ec3103e66d0c3bde44fbc9f87a0524d1a6a54813f113f5a4b868d6de11892d7d0832b4c5451b8306d78f30aa39
- SSDEEP 768:g6eOs+ZvzKLiMHp0g1pMVLg+zFYwD4LSX67S/A5gxQEpn7y:g/W7KOMJhMVDzF4c67S2gfe
- TLSH T13003F174096C412CDE5E977082D9E34CC424F0A4302CEF970BA6B9D4A7568AE3EB9F0D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/acidhead/cilent.exe unpack001/acidhead/server.exe
File Explorer
-
acidhead.zip.zip 36KB
-
acidhead/acid.txt101B
-
acidhead/cilent.exe.exe 282KB
-
acidhead/server.exe.exe 14KB
acidhead/acid.txt
- SHA256 4182e405744d1fba777e0cec81087a12ddccca584aa90b292404d85dd5799b92
- MD5 538eb43f77f40a6d70713d4b5b1acd50
- SHA1 0973cd29ac30ccc91d6f72f67ccfa7fa38b1bf53
- SHA512 ca7a3d7366c65ba010ad1aacfca7d0f5b3d56a5bc25f3135f3d2ed6a21fb19c04bb11463bcd73adf2e3b05961869ff0296ac9ac46ae3984d9d0e9ad4c1a36d3c
- TLSH T1DCB012CF9843C0831EC5B3CE17156B0420070B46CD62C381F0703D08C002889009C02D
- MD5 SHA1 SHA512 TLSH
acidhead/cilent.exe
- IMPHASH e696e246eef694b65b4f3f8e2101adc2
- SHA256 b2e9d2b8c144108f5a0e40287ce9f93db7cbfe97263a86d126010f6da2eb86fa
- MD5 3d77a6d953706d7a56af1103fc591173
- SHA1 2ec916e66f7338d7cac2730a91aff59a191a1484
- SHA512 08512627097520fa4e4488b3a2e09990a43eaecefc64cbb9d16624888ee81b466703e2d0bd8af43c4e5e09001f73e0374dd4fbfe24e5b48151ea6f3846f87320
- SSDEEP 192:FXDG9gy8LbvyyQ+jM/VsMsDJqcZj30T2jxWuVLr7D1LtRVk:FTE8LDNM/VlsbZjET2jxWuVLrFLe
- TLSH T12154233E770250ACC4D969B8B35A032AB1716C70E56835BED5E2BFA054317D2EE31B87
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4576
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm50
_CIcos
_adj_fptan
__vbaFreeVar
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaHresultCheckObj
_adj_fdiv_m32
ord595
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
__vbaI2Var
_CIlog
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarAdd
__vbaVarDup
_CIatan
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
275KB
Virtual Size
274KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
acidhead/server.exe
- IMPHASH 8a5d720af1b24783fa00ba9d2099cf55
- SHA256 499ef578a9f19d9bb9f05e8640273f50abb288d58433811824d82aae3a30baf5
- MD5 9dcebd90034bbbf13bafad04c9e79880
- SHA1 1571acaeda0ffa975715b83c2f30e7f7fd4ade1a
- SHA512 397197333dfa07a4002efcaf62590fa2a3a5b6a821c2223ac646d1542e31deea702145961d64e3214f84fe198a272bacede8cafb5e515dbe8ac010bd61a5712b
- SSDEEP 192:VymGVfLB/XE0b7mjPsLDgF2hMrB8wMjYHIvRnDr4DbSJk:E9LRU0Pmj1LBLVEnDr4Db
- TLSH T1C652A822F6BE8461F35A4AB20E3397B9451BFD607E91861F35897F8C2D36600AC1375B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4532
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm50
_CIcos
_adj_fptan
__vbaFreeVar
__vbaLateIdCall
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
__vbaStrR8
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
ord534
__vbaI2Var
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarDup
__vbaStrToAnsi
_CIatan
__vbaStrMove
__vbaStrVarCopy
_allmul
__vbaLateIdSt
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
724B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ