Packagebomb.zip
- SHA256 fffc7905006a0ce67adf7f78e1840b1794a5f574dc990c0feab6411e7c512628
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release/PackageBomb.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
Release/PackageBomb.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
900 seconds
General
- Target Packagebomb.zip
- Size 270KB
- Sample260809-yn3qrax1cy
- SHA256 fffc7905006a0ce67adf7f78e1840b1794a5f574dc990c0feab6411e7c512628
- MD5 d945b19f25885b1fd5f605c4e34664cb
- SHA1 34a6478f1583902ae48592e6568e6254f184e5c4
- SHA512 c62cfb7b47980ad9e9f018ab6b2c65d9e648bd690189eadc3a88f9b89b4c98c64495ea0125955fcc30b08f6ddc3bd51a522b391f8511cf927f4a1e2c54317306
- SSDEEP 6144:OdrHjZRtUipaX7+ZEVEhnFJMM52Sj/Vl/JJDDxxGr6Y:OBG21hnvMM52iVl/JJvarL
- TLSH T16F442338BD85D48FAD45B53FE92C04B7591748A3F2082E8A03768B171FD02C6C7DAEA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/PackageBomb.exe
File Explorer
-
Packagebomb.zip.zip 270KB
-
Release/PackageBomb.exe.exe 26KB
-
Release/PackageBomb.pdb1.2MB
Release/PackageBomb.exe
- IMPHASH e8266a750c082050cf80239dc930cea4
- SHA256 75d809e9efdc9343e4d0f381b4ef3b7eebeb31e02f2bfdfe0ed1bf6e7397230e
- MD5 65fa544e52e6be5e2beb9a66f790b856
- SHA1 d98f0f8415f06d6172b0e936d4da9f16dd9f8470
- SHA512 bdce48cf2ea0932bc47b8ca45b821974dda4b299c3fb849f4f716d15c656dd00c4fdad009c58db7aa377142f486ba308ec9ae3be3c408a6c2c420377c865c667
- SSDEEP 384:RRUtx7cZ8vguWi6cumiQxXb5ez4tA8u1LVEwWJHfjiW2vFvvO+07kyKmeDaTpT:D94gBi6BmiQ5Fez4twIw1KKPadT
- TLSH T192C25B12B7C808D9F73B96778DF16925D676B4116B32E2CF0B80121E0D36BD1D93AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11328
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Bomb\PackageBomb\x64\Release\PackageBomb.pdb
kernel32
CloseHandle
ExitProcess
CopyFileW
IsDebuggerPresent
CheckRemoteDebuggerPresent
DeleteFileW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
SetFirmwareEnvironmentVariableA
CreateFileA
Process32NextW
GetTickCount64
Sleep
CreateToolhelp32Snapshot
GetFileAttributesW
GetCurrentProcess
SetFilePointer
GetModuleFileNameW
WriteFile
Process32FirstW
GetCurrentProcessId
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
user32
ExitWindowsEx
MessageBoxW
GetSystemMetrics
advapi32
RegCloseKey
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
GetTokenInformation
shell32
ShellExecuteW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromString
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
iphlpapi
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
__std_exception_copy
memmove
memset
wcsstr
memcpy
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-runtime-l1-1-0
_initterm_e
exit
_exit
terminate
_cexit
_initterm
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_get_narrow_winmain_command_line
system
_initialize_onexit_table
_c_exit
_crt_atexit
_initialize_narrow_environment
_seh_filter_exe
_set_app_type
_register_onexit_function
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
malloc
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-string-l1-1-0
wcslen
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=26, id=261, version=35721,
count=6, id=257, version=35721,
count=1, id=260, version=33145,
count=13, id=257, version=33145,
count=91, id=1, productName=Unmarked objects,
count=1, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
Release/PackageBomb.pdb
- SHA256 31a922fc82de79a1611482314f9ed305017fb7e6339ff416ceb3bd5bbdc2c5c1
- MD5 c2dbc60f0f0c6b3d8f01c6acbf4712aa
- SHA1 87561dafe49989a44e0d460c29b195dbd175cb24
- SHA512 4acbf5efd7dec34c2778f49096421f01ea78d9ce9b55c5a5a6a05bc644f550b0635ccdabe36bf815b6cc50e55bf00cc1915d78265a7c6fd34602637c09294abc
- SSDEEP 24576:kunPwhwu58mLrc9aGywPAXNrZE75kFpQNuX81nV2tv4UZMq40LSjrLjrVsw5i/2h:kDhwu58mLKuX81nV2tJ40LUrVsw5d2C3
- TLSH T178454A66E6698E33C40E477AA1070B1C23C8DE07ABCA37D78146B1515DFE3589F3E992
- MD5 SHA1 SHA512 SSDEEP TLSH