dancer.zip
- SHA256 9c49e7855a16456c128290cd0b70fef452b369b3359a1b1717793f2a1e673956
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
thedancer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
thedancer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target dancer.zip
- Size 189KB
- Sample260807-ajtqaadj4w
- SHA256 9c49e7855a16456c128290cd0b70fef452b369b3359a1b1717793f2a1e673956
- MD5 67be23f096738df616741b307e0d53fe
- SHA1 2cd36bf0253a478b621ef570f3c2728eb5387f14
- SHA512 ef89636870e021f30516bc98564b15c3970f1207314a8ca3ae58bbbb7b3bec0a58ccc05310f61a278ffb1ba8a2d34ab96d642a74796546c6c606ad0cc9e9aa2b
- SSDEEP 3072:zbC4UDeQekWVpw2Rb0/jEbyi8uMrnRPceP2sHbVXYBMYUUK5qfcoEiSJI3N4C7kF:/CFDXeFpwGRySMrnRPRP2wbRYDdL05wa
- TLSH T18414137121C459299ED8FF2E3ECE03C6B255DE1BBEE52F420E900BC8DC22268652DDD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/thedancer.exe
File Explorer
-
dancer.zip.zip 189KB
-
thedancer.exe.exe 345KB
thedancer.exe
- IMPHASH 75c3811b239a6c75e270610d830e276d
- SHA256 063b703bc745e06b4611fe4cac9ee2afa390f03fec9eb5105bbd32ca7f34786f
- MD5 0d7762caa70984e39c8530bb4934deda
- SHA1 d101e1485c03f5d72db95f48aff544d1816b99ad
- SHA512 bdfd5a27e5231040d2df8cf413700a7c13ec63f5c15fb52293ed269fe32f04e1ff5f038d63d6a53a0c38e9c9224aaac53fc2d205184a8cd8f2ddb9daa1ebed27
- SSDEEP 6144:dY71eudi4U9YHxmRws9/sEhZCw18PvP1M/CRANYmmBPTI3Hno51:iB1dhwvRL0S8PgbYmIPTUo51
- TLSH T1A074BF0DE7D2C5F1E8E6563450A36B7667386F0AC82BC7872754EE6A3C33211FA09359
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameA
SetErrorMode
LoadLibraryA
GetACP
IsDBCSLeadByte
GetCPInfo
Sleep
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
CreateProcessA
WaitForMultipleObjects
CreateThread
GetLastError
ExitThread
WinExec
CopyFileA
WriteFile
SetEndOfFile
DeleteFileA
GetVersionExA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
CloseHandle
GetStartupInfoA
GetCommandLineA
GlobalUnlock
GlobalLock
lstrlenA
GetModuleHandleA
ExitProcess
GetProcAddress
GlobalAlloc
QueryPerformanceCounter
GlobalFree
user32
ClientToScreen
DeleteMenu
LoadMenuA
ScreenToClient
TrackPopupMenu
WindowFromPoint
GetCursorPos
FillRect
SetTimer
KillTimer
SetCapture
ReleaseCapture
SetCursor
EndPaint
BeginPaint
MessageBoxA
PostMessageA
GetDlgItem
GetWindowTextLengthA
GetDlgItemTextA
EnableWindow
GetWindowLongA
GetClientRect
CheckMenuItem
DestroyMenu
SetMenu
InvalidateRect
MoveWindow
DialogBoxParamA
EndDialog
GetSubMenu
EnableMenuItem
DefWindowProcA
DestroyWindow
PostQuitMessage
LoadStringA
CreateWindowExA
ShowWindow
UpdateWindow
LoadIconA
LoadCursorA
RegisterClassA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetWindow
GetWindowRect
SetWindowPos
GetKeyState
GetClipboardData
GetMenu
SetWindowLongA
GetDesktopWindow
OpenClipboard
SetClipboardData
CloseClipboard
GetDC
ReleaseDC
SetFocus
SetDlgItemTextA
GetCapture
gdi32
CreatePalette
SetTextAlign
SetDIBitsToDevice
GdiFlush
StretchDIBits
DeleteObject
CreateCompatibleBitmap
DeleteDC
CreateDIBSection
GetDeviceCaps
CreateCompatibleDC
BitBlt
EnumFontFamiliesA
LineTo
MoveToEx
SetBkColor
GetBkColor
SetBkMode
GetBkMode
ExtTextOutA
GetTextExtentPoint32A
CreatePen
Rectangle
GetStockObject
CreateSolidBrush
SetTextColor
GetTextMetricsA
CreateFontIndirectA
RealizePalette
SelectPalette
GetClipBox
SaveDC
SelectObject
RestoreDC
GetSystemPaletteEntries
IntersectClipRect
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegQueryValueA
RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegSetValueA
RegCloseKey
RegQueryValueExA
shell32
DragAcceptFiles
DragQueryFileA
winmm
waveOutPrepareHeader
waveOutUnprepareHeader
timeKillEvent
timeEndPeriod
timeGetTime
timeBeginPeriod
timeGetDevCaps
waveOutWrite
waveOutReset
timeSetEvent
waveOutOpen
waveOutGetDevCapsA
waveOutClose
Name
.text
Size
204KB
Virtual Size
203KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
32KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data1
Size
4KB
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=163, id=1, productName=Unmarked objects,
count=15, id=19, version=8034,
count=1, productName=Unmarked objects (old),
count=5, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=71, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,