Nova-UD-Colorbot.rar
- SHA256 15afc424455aa1b9d0aa68e897abf30ccfe6b7c1318ba39b6d310d5f6e668fef
Behavioral task
behavioral1
Sample
MicrosoftEdgeUpdate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
MicrosoftEdgeUpdate.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target Nova-UD-Colorbot.rar
- Size 4.9MB
- Sample260811-v1237sxenc
- SHA256 15afc424455aa1b9d0aa68e897abf30ccfe6b7c1318ba39b6d310d5f6e668fef
- MD5 8d77a27a44ca2140562e9b2141185b0c
- SHA1 b4b9a27d1f2209f4043453771a106fa619b62f7b
- SHA512 4c4e99b89f91cce2ba7965edff7df7636fe3b90a5c0c6588d10ccb99cd9bf760ba7320c75d5c86dadfadc2b5b474548ec0399f0f52df4869e10ed4d05d854dc6
- SSDEEP 98304:ThHfJtji0wyAt5t8sKvl9AAIp558sEJPWWHoBzC5OjLzA8l+ss2DU79d:dHf/e8qtnK7AXpINJNHAzC8+f2Dgd
- TLSH T15336332940142F59E96B413699AC18F16F30F964739D158FC3193736EAF2FBB209E18E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/MicrosoftEdgeUpdate.exe themida - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/MicrosoftEdgeUpdate.exe
File Explorer
-
Nova-UD-Colorbot.rar.rar 4.9MB
-
MicrosoftEdgeUpdate.exe.exe 4.9MB
-
Read-Me.txt569B
MicrosoftEdgeUpdate.exe
- SHA256 39bf189b0892f7685e6c68d56bf215de0c6c9ec689bd792f69d7ce17218a3432
- MD5 9c0b443c60ee68767965a0b0f12613af
- SHA1 a52202b253524b80a6c1b2ebdc4c3acd5951ff8c
- SHA512 ff7df32eb04ab29c8cbcaaf3fe351a59268dab85e44b4eb8f30ba9e469a941c4020c8013eb846bef97789d2417900848aa4a166312600aad4252e0689c34193d
- SSDEEP 98304:HYN5uaWuaN173AAlcalLJ9pQcK3skA6T81gRr5jLRajLMdwXMUd6gyE8EghVYnI:4NQa7IlHpQcWTUgV5XI/vMqa/hC
- TLSH T14036339C42EB3FABD4FD0031DAB58D447B8152E51DAEE857B683162095FA49CC50FCB8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
52:00:8e:41:07:6a:79:93:a2:8f:4c:de:f2:de:ac:80:25:02:2e:77
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
6
Entry point
8470616
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
476KB
Virtual Size
944KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
773KB
Virtual Size
980KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
41KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
24KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=253, version=28518,
count=10, id=260, version=30034,
count=4, id=259, version=30034,
count=37, id=261, version=30034,
count=6, id=257, version=30034,
count=534, id=1, productName=Unmarked objects,
count=37, id=257, version=33138,
count=129, id=260, version=32535,
count=5, id=261, version=30157,
count=12, id=265, version=30159,
count=1, id=255, version=30159,
count=1, id=258, version=30159,
Read-Me.txt
- SHA256 425d7415bf1414b158d75d2dc8517e1c733ad00a2531c9a305325f69fa8ae3d7
- MD5 dd2f52ddbb6e1293f2dcd7853adb86b5
- SHA1 2b491d24e9a70cc80f7d7db5b49bb05454dcb20f
- SHA512 d4663e9f31a75232761416b981c3153ef9ba16f34a47d55c81a243e69308d8c28472ea846cae9c45db07597e51fee66e5c3d9646aeb8a767fbd41e5097a7faab
- TLSH T1DEF0206D5A4009BF003287FBB22CB3E0B71F00EC5130677D3850264EA3186B3811B0C8
- MD5 SHA1 SHA512 TLSH