program.zip
- SHA256 a52cf38eb658f67bb181f588b3cff3c3592750f71ffff1d15a485cafc29a278a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93helper(1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
93helper(1).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target program.zip
- Size 319KB
- Sample260809-px6pbsae28
- SHA256 a52cf38eb658f67bb181f588b3cff3c3592750f71ffff1d15a485cafc29a278a
- MD5 19852e2c70368470072029366246d360
- SHA1 c007933b3735b542565a29c8703f64af38dca155
- SHA512 f19af7eb583b5222262a561d0134cc182bce4d3c35854070e9838a98f992d530ceae56cfcf4c7fc5f5b25775e7b7301c99862a0033448add6820367ac5cf6a3c
- SSDEEP 6144:TxkDvJs8e7q5iz37oLNdNxLoo2JK1Aa20k/JZiSQoktJhaVFSZ2qT:TQs8hGMLNvCoQa21/viSutzaw2qT
- TLSH T15664234EE21CC0129ABD21BB269D20C6309D69BA15B0309D7CBF1D6F25FCF9F9714899
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/93helper(1).exe
File Explorer
-
program.zip.zip 319KB
-
93helper(1).exe.exe 593KB
93helper(1).exe
- IMPHASH 3d824444d0cb563b1360ff460804c4de
- SHA256 57556feb3a5e156c23d71c316be097bd5d934439fe73c5b22c4dc24181b5170a
- MD5 428cd05a7bca84b52067c330de2f8969
- SHA1 fba119105fa340b92ccf5352c6a3dd7ab65c7eb0
- SHA512 b2b3e7a1a5ff36321451e7ff4fb80cacdbd8b33f28c2764d9f908b2429a2acacde783f2b8fa2c06ef86a1d945f23e0e7ac34d1f64178a8b0d7e892a61554925f
- SSDEEP 12288:cVZHAD4bTOG0pwM5O2Tg69Eq/td8FG2Ot9RGmn9vbnYignzm5:c7Hz12pEq/S/mSignK
- TLSH T148D49E42F1F545E8D03FE138D686E62FEA763848171085D763E449982FB37E0A7BA712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
473700
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\93helper\93helper\x64\Release\93helper.pdb
kernel32
GetConsoleWindow
QueryPerformanceCounter
OutputDebugStringA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
IsDBCSLeadByte
FreeLibrary
DeleteFileW
InitializeSListHead
QueryPerformanceFrequency
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WakeAllConditionVariable
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileAttributesA
GetLastError
GetModuleHandleW
LocalFree
GetProcAddress
GetLocalTime
K32GetModuleFileNameExA
GetTickCount64
Sleep
OpenProcess
K32EmptyWorkingSet
CloseHandle
GetCurrentProcess
SetPriorityClass
GetSystemTimeAsFileTime
CreateDirectoryW
user32
DispatchMessageW
GetAsyncKeyState
GetKeyState
GetMessageExtraInfo
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
LoadCursorW
SetCapture
SetCursor
PeekMessageW
IsWindowUnicode
ReleaseCapture
GetForegroundWindow
ShowWindow
RegisterClassExW
GetWindowLongPtrW
UnregisterClassW
GetSystemMetrics
ScreenToClient
CreateWindowExW
SetWindowLongPtrW
SetWindowPos
GetCursorPos
SetCursorPos
OpenClipboard
GetClientRect
SetForegroundWindow
SetFocus
TranslateMessage
PostQuitMessage
EnumDisplaySettingsW
SetLayeredWindowAttributes
DestroyWindow
DefWindowProcW
GetWindowThreadProcessId
SetClipboardData
GetClipboardData
CloseClipboard
EmptyClipboard
advapi32
RegSetValueExA
RegCreateKeyExA
RegCloseKey
shell32
ShellExecuteW
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
msvcp140
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
winhttp
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpReadData
WinHttpOpen
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpConnect
crypt32
CryptUnprotectData
CryptProtectData
powrprof
PowerSetActiveScheme
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
winmm
timeBeginPeriod
timeEndPeriod
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
__current_exception
_CxxThrowException
__C_specific_handler
__std_exception_destroy
__std_exception_copy
__std_terminate
strchr
memchr
memcmp
memcpy
memset
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
fseek
__acrt_iob_func
ftell
_get_stream_buffer_pointers
_fseeki64
fread
__stdio_common_vfprintf
fsetpos
ungetc
fgetpos
__p__commode
fwrite
setvbuf
__stdio_common_vsscanf
__stdio_common_vsprintf_s
_set_fmode
fclose
fflush
_wfopen
fputc
__stdio_common_vsprintf
fgetc
api-ms-win-crt-convert-l1-1-0
atof
strtol
strtof
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_beginthreadex
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_invoke_watson
_errno
_configure_narrow_argv
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-string-l1-1-0
strncpy
strcmp
isalnum
strncmp
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-environment-l1-1-0
_wdupenv_s
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
powf
atan2f
fmodf
acosf
log
sinf
sqrtf
pow
cosf
logf
ceilf
expf
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
463KB
Virtual Size
463KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
106KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
720B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=31, id=261, version=35207,
count=6, id=257, version=35207,
count=29, id=257, version=33145,
count=296, id=1, productName=Unmarked objects,
count=7, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,