Force Trojan 1.61.7z
- SHA256 24be7a14c10217b1b1068f2af3a604cef85a3e8a6717d6e9662b9d39f923bb01
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Force Trojan 1.61/DxDiag.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Force Trojan 1.61/DxDiag.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Force Trojan 1.61/FORCE.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Force Trojan 1.61/FORCE.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Force Trojan 1.61.7z
- Size 172KB
- Sample260809-vf9ybasckd
- SHA256 24be7a14c10217b1b1068f2af3a604cef85a3e8a6717d6e9662b9d39f923bb01
- MD5 585fe53b8aa67cbc8d0b4ba3a4bcdeed
- SHA1 6224a86b7ab77188cbf9ad96393533a9c28b5026
- SHA512 cf36b167d57b7044df07078f8bc81ea1c8e09730144cb5ca9f87d9482ab650aaf61e97cff2332f9920c5d61d4f27b30fae593fbeef07da5a7d2eb86ee3b14f6d
- SSDEEP 3072:3WMi9czW8SFUAPiRsvt/aOba1P60rDgRvd4R92t:mMi9cSgUty+a1iO9Rwt
- TLSH T187042292D719771EDD694B3436896627B330826FBE6D4077BEE6E4D43278DC834A01C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Force Trojan 1.61/DxDiag.exe unpack001/Force Trojan 1.61/FORCE.EXE
File Explorer
-
Force Trojan 1.61.7z.7z 172KB
-
Force Trojan 1.61/DxDiag.exe.exe 159KB
-
Force Trojan 1.61/FORCE.EXE.exe 144KB
Force Trojan 1.61/DxDiag.exe
- IMPHASH 9c8decf3582072f6edfc385a689f44f4
- SHA256 d5898e271fd338327c7a1a6189982a5627ea1ced1614cfbc474218aefb6e21d7
- MD5 d57b4964b9916ff17ddae8a862f17d66
- SHA1 ef0f5a0ecc610cc8aaa89cb34a4a48270cff8683
- SHA512 1ac3faef2318ad69905e2527330b90314281263db3707e3e124693e735e90209058d4786646df9a547afc15eff8d0cf0e7784b8be6727dca7ce9938da1707ee3
- SSDEEP 3072:2fzqIkDoaEE/zM75OfQVCEhoHTMykYQ9JY1cO3tmjKVFzEWEw:AlkDlEEKYEhozStJY1cOwqCp
- TLSH T113F312D58B08AE94F1F23AB349608F5DA047E9E5235E733E27DE0390896B149F47D0E2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
258048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
DeleteFileA
ExitProcess
FreeLibrary
GetCommandLineA
GetFileTime
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryA
lstrcatA
lstrcmpiA
RemoveDirectoryA
SetFileTime
VirtualAlloc
VirtualFree
WriteFile
Name
pec1
Size
28KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pec
Size
1KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
pebundle
Size
55KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
pebundle
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
pebundle
Size
52KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
pebundle
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=14, version=7299,
count=17, id=9, version=8041,
count=1, id=13, version=8169,
Force Trojan 1.61/FORCE.EXE
- IMPHASH d63aa9feae47364466a9425b92a05468
- SHA256 ef7befe383ad02907bd884edb49a50df779a1297a5056fe0a553cf969ea0b292
- MD5 09f79e9ce1eec4d47cdfeaabe7ae8f7a
- SHA1 8711647cbc40355b474629f9b3f8b4a942843b21
- SHA512 4f46083423a914c49d81913d5a86690added98914d153e9bc2f447032ee6105208230a0a8bd514695484bfcfd51dace0e92f75caa58193ee297eb903dffd0a8f
- SSDEEP 3072:4RSotyeem+tgSFcG3xi7dZgx+io27/YD:2j9+peTJSxLoc
- TLSH T1B9E3DA17AAB8DB52D6560AB10C275BB8043BFCB10850D64766C07E6D7EB7F83993231A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7460
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
__vbaPut3
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
ord519
__vbaStrCat
ord660
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaVarForInit
__vbaExitProc
__vbaObjSet
__vbaOnError
ord595
ord596
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord304
ord598
ord520
ord309
_CIsin
ord631
__vbaVargVarMove
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaStrR8
EVENT_SINK_Release
ord600
_CIsqrt
ord310
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord312
ord711
ord712
__vbaPrintFile
__vbaStrToUnicode
ord713
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
__vbaStrVarVal
__vbaUbound
ord534
__vbaVarCat
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaR8Str
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarAdd
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaVarLateMemCallLd
__vbaVarCopy
ord617
_CIatan
__vbaStrMove
__vbaAryCopy
_allmul
__vbaLateIdSt
_CItan
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
Name
.text
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=10, id=9, version=8041,
count=1, id=13, version=8169,