t.zip
- SHA256 a0a319f0e3c40de2beb3b5323c667731219bb0ca8646e77fbf065978dacf8e5f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
t.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral2
Sample
t/idk.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral3
Sample
t/shellcode.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
600 seconds
General
- Target t.zip
- Size 104KB
- Sample260808-w2n4easfna
- SHA256 a0a319f0e3c40de2beb3b5323c667731219bb0ca8646e77fbf065978dacf8e5f
- MD5 a6b1f291826b8b4756ed1e890620ff77
- SHA1 244d2e93a387d9c198ce0d8487e324884c7baf18
- SHA512 4f12007b16a05671d347d80a6bf6f4ac71d1cf5a8915c6eb8b5a1c37f5cb47d4bae0621edcd3d035b4782cf14964a8cc125cd10d7e1497c2ac5b886f1bd7852e
- SSDEEP 3072:n7RtRNl45R8JL7t4JqFf2jPDXvFplrd0WHgJQMON:nd305RK7tbFePvFPryWAJFk
- TLSH T1BFA312E4EB688168EAC56AB8BBF85B4002940C555CEB400F015FB2FDF246F7547AC6B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/t/idk.exe
File Explorer
-
t.zip.zip 104KB
-
t/idk.exe.exe 205KB
-
t/shellcode.txt840B
t/idk.exe
- IMPHASH a4db78246c4567f65a84e9e5f45d8caf
- SHA256 f507ca638313329d47238ab5f75add84febf51f4fe5981dddd3d0919081d461e
- MD5 56342e6282b25571e28449d774e73440
- SHA1 7d1eb383c9d564fd85c6250875bb3cfb383fb752
- SHA512 b01185e8f63ba81bf4b7ab3ea8e68391424a9e5a60c48cd8258b7e9de1516544ba3d8a558beba2c5027186dbd4b75ae741d4540f243cff1544c595b2059e45b4
- SSDEEP 6144:xW7m7CGtlqh2haeedd5lLVpebv0S8MnNaLu:WGtlqh2h76HlBUbs2+u
- TLSH T1CF249E5577A540F9E1B35538C9928216E6737C250760EBEF03A44376EF232E0AD3E792
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
30880
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
GetTokenInformation
OpenProcessToken
kernel32
CloseHandle
WaitForSingleObject
GetCurrentProcess
CreateRemoteThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32First
Process32Next
RtlVirtualUnwind
GetEnvironmentVariableW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
SetEndOfFile
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
ReadFile
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
RtlCaptureContext
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
HeapAlloc
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
CreateFileW
GetFileSizeEx
HeapSize
HeapReAlloc
WriteConsoleW
Name
.text
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=157, id=261, version=33145,
count=12, id=260, version=33145,
count=7, id=259, version=33145,
count=9, id=259, version=35721,
count=16, id=260, version=35721,
count=43, id=261, version=35721,
count=2, productName=Unmarked objects (old),
count=3, id=260, version=36248,
count=5, id=257, version=33145,
count=100, id=1, productName=Unmarked objects,
count=1, id=261, version=36248,
count=1, id=258, version=36248,
t/shellcode.txt
- SHA256 7550dcb37a1bf5502248d2c3998514dc2bd337a3edc52524800ca125c86bc468
- MD5 d8a5d3a2a6b4f2d61937ebe710334950
- SHA1 fcb6812fa88b2b2e712f5f9f154eb5f448068b13
- SHA512 f35dfe4fbef0d2d13a87572ead16d3202424ac7d66bced283836a80b8068a6d5f263d2fa5a9532ae0762b472bc19918ee143832c95e1a983177e1f6067c9e736
- MD5 SHA1 SHA512