b.7z
- SHA256 9dfbe92313bc0d309a0fb07cb6461d6c17f18b9b66842b101593373c1bf9fff7
Password
666
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
wyhrytj.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
wyhrytj.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
wyhrytj.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
wyhrytj.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
General
- Target b.7z
- Size 1.5MB
- Sample260804-vx2chawcjh
- SHA256 9dfbe92313bc0d309a0fb07cb6461d6c17f18b9b66842b101593373c1bf9fff7
- MD5 6e98c42d96b51f943091ddb291c61d88
- SHA1 d62b69b2191388faf5722f51a0c7433eb1a70bfd
- SHA512 2917ebe68cd7ac1f9c70499cef74aab4de4e9906c0d33f994f1140251cf3f66dfbc7b2a5fea09d600566437bb902c2897b3b80382fbec4e6f476d7a66a51310c
- SSDEEP 49152:qwjRY9I9m5o2OuLwG/1TEi2XpknEYmzRPRI0Qe:3NeI9mVXLh/ge6RZIO
- TLSH T1007533F1FE242D0DB25269BD58502D51290ADF31DC0A5DD0A8E93D7310DA2DE9EFA38B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/wyhrytj.exe
File Explorer
-
b.7z.7z 1.5MB
-
wyhrytj.exe.exe 784.4MB
wyhrytj.exe
- IMPHASH e0c5df6940f38fca3c0c0c22d7bffedb
- SHA256 abf1efcc80b8338fae7e93fa389ee9968ffbe9416d8fd7abdfb088c3a63703c5
- MD5 16bc0bb2da6bc9bae10b0dc3e91e20b7
- SHA1 f048714a9837614444d3f583471c3fe9a9bd66e6
- SHA512 f61aa24403440eda20f1118da00cb62da6aece5c1c52868b4cf9715c3abd667f338e650290ecbb5d152f24bed35c329d601b1e081d304daec92a3e90b7659cf9
- SSDEEP 98304:Kre8l0SOXLWwoAgGny/rNmeHRK5jAVBgLlqbToE:Ie8KNKwoiy/rNdcJuBgBqXo
- TLSH T1A0893D59D6E196B7C7D25F367EA6FC2A0680AEC3A5D8E551A3300097827F28EF4133D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
666
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseThreadpoolWork
CreateThreadpoolWork
DeleteCriticalSection
EnterCriticalSection
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
SetUnhandledExceptionFilter
Sleep
SubmitThreadpoolWork
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForThreadpoolWorkCallbacks
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
fflush
setvbuf
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_initialize_narrow_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-string-l1-1-0
strlen
strncmp
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
372B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ