fda911fb17230bca4b90d9f861aff288.zip
- SHA256 843caa4e3ed7c1ad96516e6238bde235139ccfb64c1fe738575addaf15f1a668
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fda911fb17230bca4b90d9f861aff288.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
fda911fb17230bca4b90d9f861aff288.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target fda911fb17230bca4b90d9f861aff288.zip
- Size 123KB
- Sample260810-bfc4ssstfw
- SHA256 843caa4e3ed7c1ad96516e6238bde235139ccfb64c1fe738575addaf15f1a668
- MD5 c1a72723690f8bb94867300b1fa5709f
- SHA1 a20c3ab40ec7666bb00736db8c3d660a4cbad30c
- SHA512 a5823c63d40bdb9c885fdf02c2f13516ef393944ab9f7c3bcef6983fe49037ce27fd84665905f08ba4246fb246b862caf073016bab2aa6f73f9ca382f89f0b5d
- SSDEEP 3072:R25HSLcRHHUoBp69RGsk/MkPYFAN9jX/Wii99hFeXa86iDceivMh:c5yYVq9Ru/fYKN9jX/di99KKWp0k
- TLSH T162C31220CEA30001C357DE77D096B0F6793784969E6915FCE4C6D4CDDCB6AFA227A229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fda911fb17230bca4b90d9f861aff288
File Explorer
-
fda911fb17230bca4b90d9f861aff288.zip.zip 123KB
-
fda911fb17230bca4b90d9f861aff288.exe 260KB
fda911fb17230bca4b90d9f861aff288
- IMPHASH 8f45e7b3bf59a9c195ee71d75b125d8b
- SHA256 4ea4fc4a6e17c9bff2cc22e1c9db40097470ab566eec36ce8dd23fe6b6c29230
- MD5 fda911fb17230bca4b90d9f861aff288
- SHA1 b5566f39b3833927f2772f9d18a0e2d759c1bb9f
- SHA512 e47b61d60a5f3e99f39cd1436886931a87efe930bbf93fb49d88c4a360a3492b4eb4d5e041df46a410f67c8fbd856fe13f5baa397925bb8c8c769b3345c1b743
- SSDEEP 6144:3uAW/OaaJPeAV7vGfSpknwMZVD1twdmE:DWmaOaY+w
- TLSH T18C443A167A465DFDD85AC43483468563AA2274CB0F22EDFF12C842392F6FAF56F38614
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
181024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
claude_desktop_probe.pdb
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
bcryptprimitives
ProcessPrng
user32
EnumWindows
GetWindowThreadProcessId
GetWindowTextW
IsWindowVisible
GetWindowTextLengthW
kernel32
GetLastError
FormatMessageW
GetProcAddress
HeapAlloc
LoadLibraryExA
HeapFree
CloseHandle
GetProcessHeap
WaitForSingleObject
Process32FirstW
GetCurrentThreadId
HeapReAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
CreateToolhelp32Snapshot
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
Process32NextW
SetLastError
GetModuleHandleA
GetModuleHandleW
GetCurrentProcessId
GetCurrentProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
SetWaitableTimer
CreateWaitableTimerExW
GetStdHandle
GetConsoleOutputCP
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
GetConsoleMode
lstrlenW
WriteConsoleW
ExitProcess
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
MultiByteToWideChar
GetModuleFileNameW
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
propsys
VariantToBoolean
oleaut32
SysStringLen
SysFreeString
GetErrorInfo
VariantClear
ntdll
RtlNtStatusToDosError
NtWriteFile
vcruntime140
memmove
__current_exception
__CxxFrameHandler3
__C_specific_handler
memcpy
memcmp
memset
_CxxThrowException
__current_exception_context
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_register_onexit_function
_initialize_onexit_table
_crt_atexit
_initterm
terminate
_set_app_type
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_configure_narrow_argv
_exit
exit
_initterm_e
_initialize_narrow_environment
_get_initial_narrow_environment
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
183KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35721,
count=3, id=259, version=35721,
count=9, id=260, version=35721,
count=23, id=261, version=35721,
count=225, id=1, productName=Unmarked objects,
count=49, productName=Unmarked objects (old),
count=1, id=258, version=36252,