skeet.zip
- SHA256 9ef0138b7bdf677007d0895f086dcdfd093877bdf1fc46c05cef6928c3c55b21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
skeet.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
General
- Target skeet.zip
- Size 3.6MB
- Sample260808-hppbrascmg
- SHA256 9ef0138b7bdf677007d0895f086dcdfd093877bdf1fc46c05cef6928c3c55b21
- MD5 e513b9489a29ab333af3068709259a7b
- SHA1 74da58de8443fdace089d07000c998b52717f5eb
- SHA512 505b3ccd7d93814c119ed2968a9b251bb4910c569e74d34982120d4dab60babf8a014d17964f73c758d0a7a8ded7c7558bf66c2a5cb7c989b8ca6814e42bd8ad
- SSDEEP 98304:IfBXdbSJ/yl/qwoEtjeDhzyYi+FRBQApoXCvB3dz3+v:CqKA0Yi+RBQS53dSv
- TLSH T1540633B4875811ACD62AE8F6384B1B3FC13CA91DDA26A3CD4172907B277FCA6758471C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/skeet.dll unpack001/steam.exe
File Explorer
-
skeet.zip.zip 3.6MB
-
skeet.dll.dll 13.3MB
-
steam.exe.exe 32KB
skeet.dll
- IMPHASH 33c25857a6bf516bd489ead08e91a6f5
- SHA256 e0d62338c1182f19b1363004e22df27410e13fb912a7a3e94e3b3687b9b49476
- MD5 67e44e026f6a61d5b632c11f9c4ad1b9
- SHA1 6d582a136b2107989c638b24ae475670ce08e41d
- SHA512 ae091da9c39897e308e507bad064a4480565ec014694846e6128be0b42eb97e6b2e400691a46f747dd467c75151af3389d3fa749dd1db497f55ed8ceafcfc1ab
- SSDEEP 98304:Vson7240goCyGWsb3SxXo644ltht4QB+2tDdkgCGberIIQsY2e+w3dqipW:LDnoL9jhL+2x16PY2ezEN
- TLSH T118E61912E6055C61E06DA2FCA05E2D0924A990238C957EC7731D810FAFEF58F2A7F57E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1793824
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\packett\Desktop\dump\FemboySense-main\Release\skeet.pdb
kernel32
FindResourceW
LoadResource
LockResource
SizeofResource
VirtualAlloc
LoadLibraryA
AddVectoredExceptionHandler
SetThreadContext
ResumeThread
GetSystemTimeAsFileTime
GetCurrentProcessId
SetEnvironmentVariableW
GetProcAddress
AcquireSRWLockExclusive
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
CreateThread
CloseHandle
DisableThreadLibraryCalls
GetModuleHandleA
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
user32
MessageBoxW
FindWindowA
MessageBoxA
advapi32
RegDeleteValueW
RegQueryValueExW
RegOpenKeyW
RegCloseKey
msvcp140
?width@ios_base@std@@QAE_J_J@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_detach
?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
_Cnd_do_broadcast_at_thread_exit
?_Xbad_function_call@std@@YAXXZ
?_Incref@facet@locale@std@@UAEXXZ
??1_Locinfo@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0_Locinfo@std@@QAE@PBD@Z
??0_Lockit@std@@QAE@H@Z
_Mbrtowc
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$numpunct@_W@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QBE_NXZ
vcruntime140
_except_handler4_common
__current_exception_context
memset
_purecall
__std_type_info_destroy_list
_CxxThrowException
memcpy
__std_exception_copy
__std_exception_destroy
memmove
__current_exception
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
calloc
_callnewh
api-ms-win-crt-runtime-l1-1-0
terminate
_register_onexit_function
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_errno
_beginthreadex
api-ms-win-crt-convert-l1-1-0
strtoll
strtoul
strtoull
strtod
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_fdclass
_ldclass
_ldsign
_dclass
_fdsign
_dsign
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
207KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10.8MB
Virtual Size
10.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=259, version=35721,
count=10, id=260, version=35721,
count=25, id=261, version=35721,
count=4, id=257, version=35721,
count=7, id=257, version=33145,
count=131, id=1, productName=Unmarked objects,
count=4, id=265, version=36243,
count=1, id=255, version=36243,
count=1, id=151,
count=1, id=258, version=36243,
steam.exe
- IMPHASH 14bbab0687b28c5f029a70cd681c2ce5
- SHA256 6e55ace7ec9c447fc481d924ee650b8815b907fc4c056d38e3675283966fbe43
- MD5 02387a78119e4d977c62c61917cf8911
- SHA1 4c66aa8f3b2a347aec1a6e419bba207c945ae8fb
- SHA512 2359a38e4fd05b8109c1f9ecb93216b6642a8b13e821db0302bf23536369746e07395020213d6bbab87996652b5b09e61bed53791a99e88b851e48b32d48d582
- SSDEEP 384:pN0FLimAT1qjektnnXLm/Yqlmta4f4EnRIKEuA+2C9T/Jqf1xzRuZoijtBKYkOlZ:XxCtnRB9nB7R6xqRsT7be
- TLSH T1A7E29332DD1BE137D7498CB0C9269D4A8E679CD78FE476C7BB800DE60464AD4AF39106
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13568
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\packett\Desktop\dump\FemboySense-main\Release\steam.pdb
kernel32
WriteProcessMemory
SetConsoleTitleA
WaitForSingleObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
GetProcAddress
VirtualAllocEx
CreateRemoteThread
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetLocaleInfoEx
FormatMessageA
LocalFree
GetModuleHandleW
GetLastError
GetCurrentDirectoryW
msvcp140
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?good@ios_base@std@@QBE_NXZ
vcruntime140
__current_exception_context
__current_exception
_except_handler4_common
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__std_terminate
memcpy
memmove
memset
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-runtime-l1-1-0
_set_app_type
terminate
_controlfp_s
_seh_filter_exe
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_configure_narrow_argv
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
596B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=35721,
count=28, id=261, version=35721,
count=4, id=257, version=35721,
count=3, id=257, version=33145,
count=120, id=1, productName=Unmarked objects,
count=1, id=265, version=36243,
count=1, id=255, version=36243,
count=1, id=258, version=36243,