viewbot 2.zip
- SHA256 1c66b554580de9455258bd42b77a668eb8dfd6ab0bf2f39f218e68a0c997035c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
viewbot/0x21 viewbot.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target viewbot 2.zip
- Size 5.1MB
- Sample260809-2a17jsem7x
- SHA256 1c66b554580de9455258bd42b77a668eb8dfd6ab0bf2f39f218e68a0c997035c
- MD5 ba2ad62d0acf73eae29ac0a22309a32c
- SHA1 18b27255214da5e6dd31c5ce66c9f7364f90573d
- SHA512 37b16074e5f04a655f8f0d9cf28317e1d906b7f3c49b493f2dfa7e26dc2abedd16bb06bd7ac4692caf8830a1e65e41d44334bbbd51aa00f78e36eb8d5643ba31
- SSDEEP 98304:AjDbixJ9BFSu+KX+OXx9Xf3w5a+AN/KazUi6R3p20mSWO9ELY1XzWi3bgFOdWJad:oyx7BFB+Q7XTf3w5uMaoi6j2yWO9hNWC
- TLSH T1F6463359B2C783F2062762BC29B09094FCA3CD91335A64796CDC7753302ED49AB7BE58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/viewbot/0x21 viewbot.exe
File Explorer
-
viewbot 2.zip.zip 5.1MB
-
viewbot/0x21 viewbot.exe.exe 9.5MB
-
viewbot/go.mod218B
-
viewbot/go.sum749B
-
viewbot/main.go.js 25KB
viewbot/0x21 viewbot.exe
- IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
- SHA256 056411a3ef1c584491bca1cc670b0218a91b1312676f2931f8d10532141cfdcd
- MD5 e9f16db0958b3ebbbfa466a40e0446ee
- SHA1 137d68857cc0d4cc6aa16e83660c9f472d70cf55
- SHA512 c1d40d988fa54c4748855a79dd8dfd470245e24fe10dd09d165ec3184b6c076fb8851bce8b57c88590197c96ae34fa73f2a9e3acc89cafe622e9741d0e59a4e7
- SSDEEP 98304:PIv05w/L4VC1hdb0EXrJ2WGILcdYJCZxFie3q47c3byuZ:PfS1h712tILcd5NieB7Ub
- TLSH T174A67B03EC6514E9C1AEA2748AB39262BB757C480B3227D32B90F6347E77BD06D79354
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
556960
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetProcAddress
LoadLibraryExW
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
QueryPerformanceCounter
PostQueuedCompletionStatus
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
412KB
Virtual Size
32.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
545KB
Virtual Size
545KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
526KB
Virtual Size
526KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/95
Size
215KB
Virtual Size
215KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/112
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
497KB
Virtual Size
496KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
viewbot/go.mod
- SHA256 946ff61e139546b0e1eda8a74e70fec67a99e8f8f60a71a9035d4b5f4ab5b303
- MD5 bd05a3a1988217b3fc1b7c33803561cd
- SHA1 12c09520bdf2d995704d7fe9fdb992960c830636
- SHA512 8604dc779d5641de906d5c7ea13a9fbddf6cc81b01ce29b93f52ab26bfede29419a4537bdb791dad5771239698e24ac53fe34c031b2c2ff61ffaa2ed53bed3ae
- TLSH T1C2D0A79067D868C93A1144C4D44640004EF1C060BF6DE1BC1CB32974946A491434E523
- MD5 SHA1 SHA512 TLSH
viewbot/go.sum
- SHA256 9fa3153cdd79953a93a22f76b0e78d2ce282cba952487b15e72f52461d5c8863
- MD5 d3376ac70f0f7e59d05e84b4e36e7087
- SHA1 5a0855fd2281256189b5161250647bc156381f0c
- SHA512 495bcc21f6b61c6b4489a69e126de0058d2e87e2a5f8c30873fb7a7a0b40bc1aa364ee603be5b75d9d9a7e047e50d9a2e4770f41bf85fee14c614063e7de4613
- TLSH T1BD01BD40EAE427D84BA1D864B8E5015C39A0A8106029F0FF2DF31535E4BF1824B4D93B
- MD5 SHA1 SHA512 TLSH
viewbot/main.go
- SHA256 a3b8c6131f36578a57c7bb59b696eeff6ec7bb9c4c0bfe7b89c102cc32747409
- MD5 d645b3a830c92484c7e5b1940530173e
- SHA1 079189d25b139a6f76be24211b87675dc413881d
- SHA512 a36f18601cbd793dbd87b1e04a1522ed933f11a9728efcc0b9e608cdf502ca5f8bb08d01f28988a7c32b079793340ad9ea4faa1afede2951ffe9302f94d10f33
- SSDEEP 384:ejZ6sian1oRcmdQdYNdocxykPm9T9taoH3GXb0AnbbGGC9K949kf:eJn1wEYIF3gvbCu
- TLSH T14CC22B43E359C1232C8B8008DCD8D9C897EE641748B5A8BAFCDE57F8175D6E7A2349B4
- MD5 SHA1 SHA512 SSDEEP TLSH