file_ce6d98acd69444f489e71efa7574b7bc_2026-08-06_16_13_34_398000.zip
- SHA256 72f99abbdd5ede979e690228a0ec0e05f984fcaa34e4b418d329c3a605a58dff
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
entry_1_0/$R6ZTP8K.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
600 seconds
Behavioral task
behavioral2
Sample
entry_1_0/$R6ZTP8K.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
22 signatures
600 seconds
General
- Target file_ce6d98acd69444f489e71efa7574b7bc_2026-08-06_16_13_34_398000.zip
- Size 14.1MB
- Sample260806-xvq5vsstdz
- SHA256 72f99abbdd5ede979e690228a0ec0e05f984fcaa34e4b418d329c3a605a58dff
- MD5 bda9682b9d761eaffc82a28ed715f00d
- SHA1 6aaaa04b277cdcd8fb49f688c7220c4134d3fe20
- SHA512 d1bbe2d32f4b747cc83037d22adda1d13a7e5b74914da2660d1e325bcfa42bda298f7308f666a384c5d90b046f67ab773896e0ca148a10a7bbdc6a5640fcbbf6
- SSDEEP 393216:UB1nWJxpUbFXiV7msilQXzHlVps17vacOqy:UEpkiklypspvaNb
- TLSH T1A0E6330B3E76D6B898B521B5148D0F53D9865A0EEA02EDB41F890B4A34F5314EEBC5FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/entry_1_0/$R6ZTP8K.exe
File Explorer
-
file_ce6d98acd69444f489e71efa7574b7bc_2026-08-06_16_13_34_398000.zip.zip 14.1MB
-
entry_1_0/$R6ZTP8K.exe.exe 15.8MB
-
manifest.json413B
-
script_output.txt413B
-
stdout.txt625B
entry_1_0/$R6ZTP8K.exe
- IMPHASH 117fe3d9fe356d5aa13cf1e376038d1c
- SHA256 e1a92b8257a50a34255a776f291ddbeaede606327820930eeb0671fae499dc90
- MD5 39ec548f1b85d7f97ad1d623a8ed84b7
- SHA1 4ccb9c998524ad3081094c92c0f1766bd65958a0
- SHA512 ca53f64571d83702dc358c388d5ec7897d4be325f5b0a3e1210cd8da56f8ce7e26b654a20bfdb8a1b4491ac3d064123907d6a4571599da320cb73f4e41772954
- SSDEEP 393216:p/PQfBzkMlalzCaQeFYkBXwRNVXLmfWQ7:uzAdCa7YtVXyfWG
- TLSH T1ABF6122274905273D4830BB84D53D3899AF99C09A679810BE76B218F4F7E978D7373E2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38679
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateProcessA
CreateDirectoryA
GetCommandLineA
InterlockedIncrement
InterlockedDecrement
lstrlenW
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameA
GetLastError
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
IsDBCSLeadByte
GetProcAddress
LoadLibraryA
GetShortPathNameA
GetWindowsDirectoryA
GetEnvironmentVariableA
DeleteFileA
GetCurrentProcess
GetSystemInfo
SetFilePointer
WaitForSingleObject
LocalFree
GetTickCount
GetCurrentProcessId
GetSystemDirectoryA
GetUserDefaultLangID
LockResource
MoveFileA
ExitProcess
LocalAlloc
FormatMessageA
CompareStringW
CompareStringA
SetStdHandle
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
GetExitCodeProcess
CreateFileA
WriteFile
CloseHandle
lstrcmpA
lstrlenA
lstrcpyA
lstrcpynA
lstrcatA
lstrcmpiA
DeleteCriticalSection
InterlockedExchange
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetTempPathA
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
GetTimeZoneInformation
GetCPInfo
GetOEMCP
HeapSize
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
SetLastError
TlsAlloc
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
HeapFree
RtlUnwind
TerminateProcess
HeapAlloc
VirtualProtect
VirtualAlloc
VirtualQuery
HeapReAlloc
GetSystemTimeAsFileTime
GetStartupInfoA
SetEnvironmentVariableA
user32
TranslateMessage
GetMessageA
DispatchMessageA
IsWindowUnicode
MsgWaitForMultipleObjects
GetMessageW
DispatchMessageW
GetDesktopWindow
CharNextA
LoadStringA
MessageBoxA
PeekMessageA
wsprintfA
advapi32
RegEnumKeyA
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
SHGetFolderPathA
ole32
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
oleaut32
VarUI4FromStr
version
GetFileVersionInfoA
VerQueryValueA
wininet
InternetErrorDlg
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
Name
.text
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15.7MB
Virtual Size
15.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=105, version=2067,
count=26, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=109, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=95, version=2179,
count=2, id=25, version=9210,
count=2, id=93, version=2067,
count=15, id=93, version=2179,
count=179, id=1, productName=Unmarked objects,
count=25, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
manifest.json
- SHA256 3d91a93f4e795e64a5d91a29c89cdf59ca0aeac945a265828c616aedaab66c92
- MD5 d706f5f824a1783e0cc9e90bf0812f48
- SHA1 5b9a571b4bedaf754b8db7a04a13cb8b5a2a7257
- SHA512 12d1f20d577c80a0f40fd2a837757c77e2986219a4b15afaa3e5a0a43359aabe3daf0ec75fca86f67567d6a68b9ce4a9de50e07ae4a7e667912bd8bf97f85bd7
- TLSH T1D2E0AB226072891F5064F62A42060ACBC30200E9A3EBDA2217DC535C44C8BBA8C424C9
- MD5 SHA1 SHA512 TLSH
script_output.txt
- SHA256 3d91a93f4e795e64a5d91a29c89cdf59ca0aeac945a265828c616aedaab66c92
- MD5 d706f5f824a1783e0cc9e90bf0812f48
- SHA1 5b9a571b4bedaf754b8db7a04a13cb8b5a2a7257
- SHA512 12d1f20d577c80a0f40fd2a837757c77e2986219a4b15afaa3e5a0a43359aabe3daf0ec75fca86f67567d6a68b9ce4a9de50e07ae4a7e667912bd8bf97f85bd7
- TLSH T1D2E0AB226072891F5064F62A42060ACBC30200E9A3EBDA2217DC535C44C8BBA8C424C9
- MD5 SHA1 SHA512 TLSH
stdout.txt
- SHA256 7d5f5a421a7591e7c311236a13a73c385f3ac0269a61678c4b6756f55cb04ebc
- MD5 2bad2e11c0fb58866a72d35cf3de6be7
- SHA1 e951b7efc7f0845c27d286728ae5433a69935acf
- SHA512 724c6ab4f16bbb09883a6e6547fd36ae620e95c69412bb2f79afc17274e2a217a0cd4127dce5586831ed30523d1989616f6c225739b981ff1a1de4bda44d0b34
- TLSH T112F04E250E636755570601C5167CD697D3D0D51822ECC668F8FD41C9DE41FEDC2F8528
- MD5 SHA1 SHA512 TLSH