198macros-v1.4.0-main (2).zip
- SHA256 dfcb3d89f920f5ab921c11a261366ef43f3202bef136c876d0e6e7d2863aae6b
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
198macros-v1.4.0-main (2).zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
198macros-v1.4.0-main/198macros.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral3
Sample
198macros-v1.4.0-main/README.md
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
198macros-v1.4.0-main/gui.png
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
300 seconds
General
- Target 198macros-v1.4.0-main (2).zip
- Size 4.9MB
- Sample260810-3cvcfsbb67
- SHA256 dfcb3d89f920f5ab921c11a261366ef43f3202bef136c876d0e6e7d2863aae6b
- MD5 9d44a2dbf52c8dce8171ae71e2107336
- SHA1 4233111e176349d71345dc9a3bdbed70dee54c4e
- SHA512 0f7a90a9eb8505f6c17fac1751dd6d71e9ec367a0eac06dbedbb8bbc7cd85806db2cf0cf64e02841bd37eecd488ceb8328ce553a01708c54f635c6a0c6bd45e7
- SSDEEP 98304:yiJH5Rj+Q8DArxYoymOxKvszlF7XRyj5oBgy9OKD03CJ8nDL2uc46G3eq:yiJZ9+QDYoymTKll0jCgKx048nH2uc4N
- TLSH T10F3633A41131CB2A7C5CE7488125353AE6CA56D8AD085AA50A5DFDB30CBFCF3D1A4CBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/198macros-v1.4.0-main/198macros.exe
File Explorer
-
198macros-v1.4.0-main (2).zip.zip 4.9MB
-
198macros-v1.4.0-main/198macros.exe.exe 9.7MB
-
198macros-v1.4.0-main/README.md1KB
-
198macros-v1.4.0-main/gui.png.png 201KB
198macros-v1.4.0-main/198macros.exe
- IMPHASH 9002c40b1ecddbc3a12cec32a89fe4f9
- SHA256 a515d5965eaa6d7788f933b8683fa9182debf95e5a81b7f3b41f7e751cd412a9
- MD5 a2e9334ece4010899674af3ad17e3130
- SHA1 af7bfb58172fe2201445e99165f7a22daac93b25
- SHA512 1aa4a930c0bd83a8f008a194dfe634c20f342657dd255d99ffc109aae4bfb1fd10c7ffd64455c4d7a08af93c45c322b4811b773964b0a87f50cae20c71a28dfc
- SSDEEP 196608:A7MZ5LMk1kQtxRFaKed98eECo8ZdXyOheYAKVY:iMZ5LMk1kQtxRFaX98DCDXiXqY
- TLSH T1E8A66BE630E546DDC466C27A8343FA3BCA6F74360B3196D75564A2A61F27CC43A3AF04
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
3853028
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\vikkn\source\repos\Macros\x64\Release\macros-unprotected.pdb
ws2_32
setsockopt
sendto
htons
recvfrom
inet_ntoa
ntohs
socket
inet_addr
WSAStartup
inet_pton
closesocket
WSACleanup
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAResetEvent
WSAWaitForMultipleEvents
shutdown
getservbyname
getservbyport
gethostbyaddr
gethostbyname
gethostname
ioctlsocket
freeaddrinfo
getaddrinfo
listen
htonl
accept
select
__WSAFDIsSet
WSAIoctl
recv
getsockname
getpeername
connect
bind
WSASetLastError
wldap32
ord45
ord50
ord41
ord22
ord26
ord27
ord211
ord33
ord35
ord79
ord30
ord200
ord301
ord60
ord46
ord32
ord143
ord217
crypt32
CertEnumCertificatesInStore
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertFreeCertificateContext
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
normaliz
IdnToAscii
IdnToUnicode
advapi32
RegEnumKeyExA
RegQueryValueExA
RegCloseKey
RegQueryValueExW
RegOpenKeyW
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
OpenThreadToken
RegQueryInfoKeyA
GetUserNameW
RegEnumKeyExW
RegOpenKeyExW
RegOpenKeyExA
bcrypt
BCryptGenRandom
iphlpapi
GetAdaptersInfo
kernel32
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
SetConsoleCtrlHandler
GetModuleFileNameW
GetConsoleOutputCP
GetCPInfo
HeapAlloc
HeapFree
FlsAlloc
GetStartupInfoW
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetFileAttributesExW
FlushFileBuffers
SetStdHandle
SetEndOfFile
GetCurrentDirectoryW
GetFullPathNameW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlsGetValue
InitializeSListHead
GetVolumeInformationA
GetModuleHandleA
GetSystemDirectoryA
GetNativeSystemInfo
GetProcAddress
MultiByteToWideChar
DeleteFileW
SetLastError
GetPhysicallyInstalledSystemMemory
GetCurrentProcess
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
CreateMutexA
LocalAlloc
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
Sleep
FormatMessageW
GetTickCount64
Wow64RevertWow64FsRedirection
GetLastError
GetFileAttributesA
Process32NextW
K32GetModuleBaseNameW
CreateFileA
GetDiskFreeSpaceExW
GetCurrentThread
LoadLibraryA
Process32FirstW
CloseHandle
GetSystemInfo
LoadLibraryW
K32EnumProcesses
GetThreadContext
GetWindowsDirectoryW
LocalFree
RemoveDirectoryA
VerSetConditionMask
GetCurrentProcessId
GetProcessHeap
GlobalMemoryStatusEx
GetModuleHandleW
FreeLibrary
BuildCommDCBAndTimeoutsA
lstrcmpiA
VerifyVersionInfoW
GetComputerNameExA
CreateDirectoryA
lstrcmpiW
GetTickCount
IsWow64Process
IsDebuggerPresent
GetComputerNameA
CheckRemoteDebuggerPresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventA
QueryPerformanceFrequency
SleepEx
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
InitializeSRWLock
RtlUnwind
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FormatMessageA
GetModuleHandleExW
WriteFile
InitializeCriticalSection
ReleaseSemaphore
GetExitCodeThread
CreateSemaphoreA
VirtualProtect
VirtualFree
GetEnvironmentVariableW
GetACP
GetSystemTime
SystemTimeToFileTime
RtlVirtualUnwind
GetSystemTimeAsFileTime
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
FindClose
FindFirstFileW
FindNextFileW
CompareStringEx
SleepConditionVariableSRW
WakeAllConditionVariable
LCMapStringEx
DecodePointer
EncodePointer
GetStringTypeW
TryAcquireSRWLockExclusive
HeapSize
WriteConsoleW
GetSystemFirmwareTable
ReleaseSRWLockShared
user32
GetUserObjectInformationW
MessageBoxW
GetMessageW
DestroyWindow
CreateWindowExW
SendInput
GetProcessWindowStation
DefWindowProcW
GetWindowRect
SetWindowsHookExW
UnhookWindowsHookEx
GetAsyncKeyState
ShowWindow
VkKeyScanA
CallNextHookEx
GetCursorPos
InvalidateRect
UpdateWindow
GetDesktopWindow
PostQuitMessage
KillTimer
GetClientRect
LoadCursorW
ScreenToClient
GetSystemMetrics
FindWindowW
TranslateMessage
DispatchMessageW
SetTimer
RegisterClassW
ValidateRect
gdi32
GetStockObject
shell32
SHGetSpecialFolderPathW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
oleaut32
VariantInit
SysFreeString
VariantClear
SysAllocString
shlwapi
PathCombineW
mpr
WNetGetProviderNameW
ntdll
NtCreateFile
RtlCaptureContext
RtlInitUnicodeString
NtClose
RtlLookupFunctionEntry
wevtapi
EvtQuery
EvtNext
EvtRender
EvtOpenLog
EvtClose
d2d1
ord1
dwrite
DWriteCreateFactory
dwmapi
DwmSetWindowAttribute
Name
.text
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.vm_sec
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vlizer
Size
4.2MB
Virtual Size
4.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
count=197, id=261, version=33145,
count=21, id=259, version=33145,
count=24, id=260, version=33145,
count=7, id=253, version=35207,
count=10, id=259, version=35207,
count=19, id=260, version=35207,
count=100, id=261, version=35207,
count=2, id=123, version=2207,
count=387, id=1, productName=Unmarked objects,
count=41, id=257, version=33145,
count=829, id=260, version=35222,
count=42, productName=Unmarked objects (old),
count=126, id=260, version=33523,
count=29, id=265, version=35222,
count=1, id=255, version=35222,
count=1, id=151,
count=1, id=258, version=35222,
198macros-v1.4.0-main/README.md
- SHA256 b478e776667e916b3f13717baa9f3acf7275eae64299e975656da44e065261ff
- MD5 bb5843e7b95fa755fd64714d4ecd312f
- SHA1 b1f6bf12a22e2ef603b167aad6e01c7fe3808be6
- SHA512 b8d53af98d5ab6a21c630cb8e1a9b83807d743b9db2f63a7f674f9b27aa73bb87ac9f1a9e61a503b4abdc1b46f259343816d36303d85a558ef466154626da94c
- TLSH T13331B3B36100363C1F260EE6888C67E8DB65801483B265E9E18E415E7F46E35C33F0A5
- MD5 SHA1 SHA512 TLSH
198macros-v1.4.0-main/gui.png
- SHA256 83457ed43b5c880f674ede99a0a8f0be6a1555971ca9aa46a701e0d94e955914
- MD5 7597ec6dcc3772c30af86b0c7d154075
- SHA1 76bf2ae20cf49ef49998a5e9d74d5d926e940d84
- SHA512 2f28bb72129b1154b609d819a3972922ac305fc13bfa3a217cdb825e99c14af71ba273dd19467c345bf615518b0955f39a9adc00854ec5660431d87bb7815713
- SSDEEP 6144:01k+6QdyRxZg3hhEpHQ5wTQ9e0w0WAwz08:01TxdySg4wTaRW5
- TLSH T1431412E66930E873CDDF60302A594FCB9A5B22FCD4D16AE2D3D541AD8FD0FB402251A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected