1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb.zip
- SHA256 96d8bb2fc15aef7e05fbc300ef50196a53293e9e74115d3e51767a22d86bc634
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target 1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb.zip
- Size 246KB
- Sample260803-tknefabh65
- SHA256 96d8bb2fc15aef7e05fbc300ef50196a53293e9e74115d3e51767a22d86bc634
- MD5 b3f0186b5e7b83d568d4b5e9f480e33a
- SHA1 ed8910750f504def6b746d5adb4a1f8c3a044e3e
- SHA512 e5a95443b471af9d0cf28f63db1d0e1e42847adb4f91ce8d8de144d7cfce053a045e983f629cad46f7a8b684986ea2e1f9d503a6ccf3eaf8582e52847b0eed7f
- SSDEEP 6144:6UjkNTDxM47VfxxnFJOvxNAsTjVOKLdidlG7Q8RrcQf2zcicodDE3RK:6U077B5YpN7TtC477czfcMyK
- TLSH T17C3423612C83667AB1E7DD4ADE29D1D6449FBF21C9FC0768C02074BC215F26069EBE07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb
File Explorer
-
1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb.zip.zip 246KB
-
1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb.exe 537KB
1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb
- IMPHASH f4a522adb0fe70c2781d09aef118d0f5
- SHA256 1c66ce2862416d06ce6132c38b1d471ad75f9d3f80302279476ac462e02c73bb
- MD5 41c2b631d48901ca3f47b017d3592f5a
- SHA1 ecfcd6e489ce93f0498c392bdebecc73112260b5
- SHA512 11f3c096ff5344c404ec36074cdb31a0bad73a92365a2c28b45a615e903e41a5e5276fccc96e29f0248f0f2186958eb6573e70406d9dfb1712ab2b6dc8189894
- SSDEEP 12288:mAbgyf7vL6fg6fA6fP6f1HZIIRb5EQEzpp3eS7L:jb17vLmgmAmPm1HZjRhyrv
- TLSH T1BCC48E99B66417F9D0ABC178CE4A89F3E771B88507B0AADF03E006761F276915E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
238900
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
setsockopt
getnameinfo
WSACleanup
__WSAFDIsSet
closesocket
select
shutdown
WSASocketW
getaddrinfo
WSAStartup
getpeername
getsockname
send
socket
ntohs
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
WSAGetLastError
shell32
SHGetFolderPathA
ShellExecuteExA
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoCreateGuid
kernel32
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CreateFileW
GetModuleFileNameA
SetHandleInformation
WriteFile
CreatePipe
WaitForSingleObject
GetSystemDirectoryW
MultiByteToWideChar
Sleep
GetTempPathA
CopyFileA
GetFileAttributesA
CreateFileA
GetSystemDirectoryA
GlobalFree
CloseHandle
ExitProcess
WideCharToMultiByte
CreateProcessA
CreateDirectoryA
GetComputerNameA
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapSize
WriteConsoleW
SetEndOfFile
ReadFile
HeapAlloc
HeapReAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
LCMapStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
CompareStringEx
GetCPInfo
QueryPerformanceCounter
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
RtlUnwind
GetModuleHandleW
GetProcAddress
GetStringTypeW
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
advapi32
RegQueryValueExA
RegOpenKeyExA
GetUserNameW
RegCloseKey
winhttp
WinHttpGetIEProxyConfigForCurrentUser
Name
.text
Size
383KB
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
113KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=176, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=1, id=262, version=33145,
count=93, id=261, version=35207,
count=187, id=1, productName=Unmarked objects,
count=15, id=257, version=33145,
count=1, id=265, version=35225,
count=1, id=255, version=35225,
count=1, id=258, version=35225,