O Ritual Da Sombra - Pure Data patch.zip
- SHA256 eb9e064f9638c35a56e18a12f649b9e018572fe7608bf03e2d0278e25bd229a8
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rand.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
rand.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
rand.pd_linux
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
150 seconds
General
- Target O Ritual Da Sombra - Pure Data patch.zip
- Size 18KB
- Sample260807-gvettsec73
- SHA256 eb9e064f9638c35a56e18a12f649b9e018572fe7608bf03e2d0278e25bd229a8
- MD5 a0f71f6425ca15b2e8ab88485823c83c
- SHA1 b3742c4b997ea48b02ad9b0e4bf790081cec43d9
- SHA512 9eff8616fb61edce164b35c0d0a0f3f595297367ad5712243e28a38a9002088771eca77105cecd8602f6579dc07b7fa64e83a4c6493057298194830119ea4864
- SSDEEP 384:ZhNHk9l7OQv17wbDNuFjxZOaOR83gnHPfXkoYOuvoY2mB:ZhNHk9sG188O7R83WhaL2mB
- TLSH T16282CF85237C3B26FE54517F5FB0F190ED152F45529F4ACD2A5B92D2EA5F22309B028C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/rand.dll
File Explorer
-
O Ritual Da Sombra - Pure Data patch.zip.zip 18KB
-
O Ritual Da Sombra.pd16KB
-
rand.dll.dll 10KB
-
rand.pd_darwin.bundle 24KB
-
rand.pd_linux.elf 22KB
-
resonators~.pd42KB
O Ritual Da Sombra.pd
- SHA256 024afef55d8ac2ecd40f8fc96d0eae3360c12c073a5a60d8aecc4d8163558445
- MD5 9ba3f57d1394000e6ca0cdb932feafcf
- SHA1 0eb3081c3aeb2f7fcf0406bac8b2d4e8ee29a1c6
- SHA512 624f26304fbeb1a721fa0ffc7932bd415debdb16c26c456b226652edbc24db5883ae984760523d0da3726739c807779034246d88cb1f902586862f30ea19f60f
- SSDEEP 192:KLtKT+oVBUv25KG9yDdpdQTDnHekzrddgtU6wgfBxmDbBuX3MAIchZBZFxwJ6jiA:oiiAoZX+cSdPITEds
- TLSH T1E3720E4CAD5552AF96EFF17D067BECD18A3DB160633048904AED09B8C42A6C9F6937C3
- MD5 SHA1 SHA512 SSDEEP TLSH
rand.dll
- IMPHASH 72837bf284bb59a8c160cfe0657c6b00
- SHA256 497fd4f3c55515475d67902069ae6738d4cd0cda84aa5ba665ec186ec693f020
- MD5 34f170d669a84d886b4587755c9c1556
- SHA1 59f2287d87f0640a17ebd38a3139b52cf956bde9
- SHA512 eea2f224a5af4a73f7da8ab6a920d7854c201c19cd47be84d1299d63dcf525bfa6ad5ffb5b105920e300a95b0f28f6961eb80b06305b55ca133e664b506931e4
- SSDEEP 96:RuCbFsjVihVqF13ziorJMQjUwOUk7XHdEDclxJ1LaoEzvp6TbJXlKbKyPOXiyKMy:RckhVqDmoJDqUkJE8JUHtC58OyPy3Eh
- TLSH T1CC220985BE0234F2D41906F048FEA67F4A7D7012A42B9D14FB9CC629E93F175EB1512B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
TlsGetValue
VirtualProtect
VirtualQuery
pd
post
atom_getfloat
outlet_float
freebytes
pd_new
floatinlet_new
outlet_new
getbytes
gensym
class_new
class_addbang
class_addmethod
s_float
msvcrt
__dllonexit
_errno
_iob
abort
calloc
fflush
free
fwrite
malloc
memcpy
time
vfprintf
_nm___iob
_nm__s_float
rand_setup
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
113B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
356B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
rand.pd_darwin
- SHA256 e1d7e1b9ffe18abd2128cd7ab13a05601a1397f4ecdc2d67084e54508ba39b1c
- MD5 61f74c310188c33324770455af4cb111
- SHA1 2c846d92d95553d7e3bf49fe93a96269ed67f8d8
- SHA512 ee2d70626dd7c006b84560a24cdb71b46696729fa27c9926eb0410d9fcad22b8c472ab50b18bc513858b9ac586b4a085ba3b2c50004d0e6ceec3b3f60378704e
- SSDEEP 24:hA7ft8k/8QyLbuLrJLCIYcgqSKhFMStYzX3O0Mfk/8IGbFLUGjGDzwhuKFFMKpan:ywWrt10MFMamX389UG+zzgFMKp+6s
- TLSH T191B27850AB8C6A77E41D07B885DA03CA7172F9805FE28E1B9845C5502F523AD68B1E5F
- MD5 SHA1 SHA512 SSDEEP TLSH
rand.pd_linux
- SHA256 2461659fa3edf82451728f2156065318c722d8d818d0b18b597e11c1a5c78927
- MD5 5ed9de606ff693d4e5f30b1ab0927756
- SHA1 e00eefc1f3ceeebf2f2398f532a57c79c2ccfa25
- SHA512 4212c1c807fe778bbf6bcaaf956e29a66192bd1cfc7780abab45af83f2ccebd4c717c49bb31ec0285e36869ddf4f99321954e63e4ae38fb0c8260c5f5385bb5f
- SSDEEP 192:RF8p644wn1i4BG8Ww3kGaptP25FfKBfHkrSuxjhOf2oEtm2cIro6BVLL7fqN0tY6:dwweRLa3PEJKBv6Swvk6p
- TLSH T172A2E50BBB9589BFC4994379C9DB433173B6E8000B538F2B2A1952B46D5335CBE6198A
- MD5 SHA1 SHA512 SSDEEP TLSH
resonators~.pd
- SHA256 ba30681e05924b13782bc4f5e65dc56e2580726add955e0f891ac307f6ca8163
- MD5 511c55ceba1e978c326ef0f72e492041
- SHA1 194633e18a6b49522c72b60fddf6f3e86917bdd4
- SHA512 4da6cfed9a0cb81609424e38e01a9c9311c9ed9cfe78e60fcaeef895554c855599049434beb6199dc40b81fa57d1bde6747d3527786694044adc58c3dad39ec5
- SSDEEP 768:fzxzsz2zIzizEzpzvzlzLzhzSzgzuzcz6z7z9zHzZzXzPz9zLzJz3zMzqzuvzuzm:fzxzsz2zIzizEzpzvzlzLzhzSzgzuzcd
- TLSH T14E13465CAD9550EB52DFF4AE063B9DC4827AB026233449854B9E08BCC5277D1FAA33C7
- MD5 SHA1 SHA512 SSDEEP TLSH