New WinRAR ZIP archive.zip
- SHA256 ea17ab13189dd76f794b540968f45029f35f2f25311668f3f277940615509086
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Vixen.Free.Temp/Items/cat.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
Vixen.Free.Temp/Items/catmapper.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
Vixen.Free.Temp/RUN ME TO SPOOF.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
300 seconds
General
- Target New WinRAR ZIP archive.zip
- Size 72KB
- Sample260807-edd5vszway
- SHA256 ea17ab13189dd76f794b540968f45029f35f2f25311668f3f277940615509086
- MD5 94a2a6bba3db5c164e8ae695d6aeff79
- SHA1 2f64998b067c79955053a53a63c6bbc565b555e5
- SHA512 b7551fae94d6b603b816966e12dbb478454b609fdc0e4bb383bd118752d8551d16a85c22566d11dba4054956f4343fb722d083f75fb5bdbf92bc9011715960ad
- SSDEEP 1536:840GDrAGOCagtRKG44CrR8Xj7miZSTx/4b6Dztb6iK2o:8ArAGlUKX3miaxwuPxcv
- TLSH T1D973021B918D5213D28A6C7C8DC6278C91D45FBAF87C14126229FDE62C41FCFCDA2999
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vixen.Free.Temp/Items/cat.sys unpack001/Vixen.Free.Temp/Items/catmapper.exe
File Explorer
-
New WinRAR ZIP archive.zip.zip 72KB
-
Vixen.Free.Temp/Items/cat.sys.sys 13KB
-
Vixen.Free.Temp/Items/catmapper.exe.exe 147KB
-
Vixen.Free.Temp/RUN ME TO SPOOF.BAT.bat .vbs 2KB
Vixen.Free.Temp/Items/cat.sys
- IMPHASH 4dadd71bbf7efc91b6e42c18159125b4
- SHA256 57e7df3f98bcf95885d8b6a1dd007c842f949be018cbf2d807c28df1b0d29a2e
- MD5 18618bad050352ade088baccac516cb6
- SHA1 81715bf5b749748a4a1b030b49d4a01e55ce1ca3
- SHA512 f8d6beb0e8deb0c5d706839d14afdfe35fcb8a3c1d193437af83d68e6b86b889a9548a4b25bd01781c7edf369b842567e2b47a4be621fe963d9fbc8bb795566b
- SSDEEP 192:YOzu830PlOQ7OlpAVtgt2sMmVcgYcHHSCX51cmC3FIhXP:YH0WOwCtdMmVcg5DPC3FIh
- TLSH T153521A8B922414EEE36E407AF5209D26E1F2F0850391D6DF5766C63E0B63BE0757B781
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5564
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\conspiracy\Downloads\realwoofa\cat\x64\Release\cat\VixenSMBIOS.pdb
ntoskrnl.exe
RtlInitString
RtlInitUnicodeString
KeInitializeEvent
KeWaitForSingleObject
ExAllocatePoolWithTag
ExFreePoolWithTag
IoBuildDeviceIoControlRequest
IofCallDriver
IoGetAttachedDeviceReference
IoGetDeviceObjectPointer
ObfDereferenceObject
IoEnumerateDeviceObjectList
_vsnwprintf
ObReferenceObjectByName
IoDriverObjectType
vDbgPrintExWithPrefix
KeQueryTimeIncrement
ExAllocatePool
swprintf
DbgPrintEx
MmMapIoSpace
MmUnmapIoSpace
RtlRandomEx
strstr
MmCopyMemory
ZwQuerySystemInformation
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
INIT
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=259, version=33136,
count=1, id=260, version=33136,
count=3, id=257, version=33136,
count=33, id=1, productName=Unmarked objects,
count=10, id=261, version=34808,
count=1, id=258, version=34808,
Vixen.Free.Temp/Items/catmapper.exe
- IMPHASH f98f9c16ac6c013dc22d37c379d00ee0
- SHA256 da3b80cb01f8d568553355d45d11ccf445010c6817becc08d2ef5726609bb07c
- MD5 3c5657b526c9a310e4ed479c3d7b3d41
- SHA1 1704f48aa80ee471a3f58c4aad9a02f34ec3aee7
- SHA512 708e161050030282bd36c5969d693278ce3aaaa17fd76ac511f549a2ac634b26c5b857fcbef855daaeb1dda732bc972605c9d244a94c5eb77ef57bd57bfe0826
- SSDEEP 3072:h72o4BCdZJBuL2+kwjmJTQSaMm5/6NQzl4:h72LBoZJB3TWl6K
- TLSH T109E33C5797A51069E2B7DABCDA720902EBB27C454B74D2CF135048B90F62BD0AF3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
62872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\conspiracy\kdmapper\x64\Release\kdmapper_Release.pdb
kernel32
CloseHandle
GetProcAddress
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetModuleHandleA
GetTempPathW
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
CreateFileW
VirtualAlloc
DeviceIoControl
SetUnhandledExceptionFilter
VirtualFree
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
LocalFree
user32
GetWindowThreadProcessId
GetShellWindow
advapi32
RegCloseKey
RegDeleteTreeW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
msvcp140
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
ntdll
NtQuerySystemInformation
RtlInitUnicodeString
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
memcpy
memcmp
__C_specific_handler
__std_terminate
wcsstr
__std_exception_copy
_CxxThrowException
__current_exception
__current_exception_context
__std_exception_destroy
memmove
api-ms-win-crt-stdio-l1-1-0
_set_fmode
_fseeki64
fread
fsetpos
_get_stream_buffer_pointers
__p__commode
fputc
setvbuf
fgetpos
fwrite
ungetc
fflush
fgetc
fclose
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_wremove
_unlock_file
api-ms-win-crt-string-l1-1-0
_wcsicmp
_stricmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
__p___wargv
__p___argc
_crt_atexit
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
terminate
abort
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
_callnewh
free
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=34321,
count=10, id=260, version=34321,
count=35, id=261, version=34321,
count=6, id=257, version=34321,
count=9, id=257, version=33140,
count=231, id=1, productName=Unmarked objects,
count=7, id=265, version=34809,
count=1, id=255, version=34809,
count=1, id=258, version=34809,
Vixen.Free.Temp/RUN ME TO SPOOF.BAT
- SHA256 46c08538f7abcc763ac3a727dc89894e68fd2f1397d05e37cc76fac59a57a204
- MD5 e0c7c988717bd1cc916b88a0a019ddb6
- SHA1 a0e40153cd21feea559534f51e7463025e5fbbae
- SHA512 b3e62ae42890e7d4a1a31fc69e23a009906dbb514f64ac539c35de54b1856bfa1a160debbea3b5fa90ba2aafc0d5aa68b594951960fdeda78b04959a24492484
- TLSH T1BD51270A2E8BC6B156F0C4E587616051F506B30B1A195DD4B4AF90D45F253C1ABEE7EC
- MD5 SHA1 SHA512 TLSH