0𝙋e𝙉_𝙎𝙀𝙏𝙐𝙋_𝙁!1e.zip
- SHA256 3ecdcdf339cea8c07f1a1f0fb82bd5afda378924d9333081af00ade8b8a30eca
Password
3223
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
setup.exe
Resource
android-35-x64-arm64-20260325-en
android-15-x64
0 signatures
150 seconds
General
- Target 0𝙋e𝙉_𝙎𝙀𝙏𝙐𝙋_𝙁!1e.zip
- Size 1.0MB
- Sample260812-rd67vswwds
- SHA256 3ecdcdf339cea8c07f1a1f0fb82bd5afda378924d9333081af00ade8b8a30eca
- MD5 1a1add23506aaf607b9aad7832550431
- SHA1 289097513116c232aa621299aaa2d9743f642f53
- SHA512 3ae39dc6a6c017eebfc69e8a2ffd4ef8ff27730048ce2805e21f31c604ff3f5a732795d3dcdff7b9fa1c00cede9cdb8b38b9b65b1b6cf27edf575616a884938a
- SSDEEP 24576:h1FJQwUB+2E0HmNiMrk7v9EA/Aaj/GrcXvYL:xi9EqNMrWuOpj/pXQL
- TLSH T1263533A87279E1A5FE3BB70C262DB1BD321397D0AFE98D478830417F75E95A1C20216D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/setup.exe
File Explorer
-
0𝙋e𝙉_𝙎𝙀𝙏𝙐𝙋_𝙁!1e.zip.zip 1.0MB
-
SETUP.zip.zip 1.3MB
-
setup.exe.exe 80.0MB
SETUP.zip
- SHA256 b204ddebea99a97541a5868890011f16bb23b2ddc938d0f14dde17eb2b0509ee
- MD5 1444dbc94f85d38f766b12108c06d609
- SHA1 59a3351a085fff5b5990b5192f1f043e84c62289
- SHA512 3bab735c1629e2bbf9650190d626ce7f69d4f8c1cf5cdb510ce87c9c9691b05cf2b926d714475bd726a30f8e07d018bf9cac066721372d14b9802cd43b9d5349
- SSDEEP 24576:oCPaa29caBT9iOEeflJzyQFWO4R9ZVNzD94KmCLeg:oE2DjHzzgRR9RDSqSg
- TLSH T1AB5512A5B06C3A89C8C9DBFC5448BDDE46770460E0152A330D670276FB8772EBC769E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
3223
setup.exe
- IMPHASH 4cea7ae85c87ddc7295d39ff9cda31d1
- SHA256 e951882145a0af906090c3d1610362bfb2c4f0201fa8d866f0de5bba8dd31f42
- MD5 a15b334c54b26344be064191bf9cacae
- SHA1 f4ee1eb875a217af2103025dffce8d496e2f1018
- SHA512 6b41bf16a4495d6cddf99dc9c2ef3627e05de6c7715c671c82d8b63f701966aabc2c25ec3a9055b80a329719d54c63478f2febc7c742f0201edccc8bcb2d52dd
- SSDEEP 24576:Tjbcr0Mm9M89pBia0gjltCEbQAUcdrZxLzVXiKmyuT:TjgrYN7vVkLcdr7VS6S
- TLSH T1D50811EEA30D945E2ECAC067AB31B9DA17A56E4271B2016C7619341BA712F4CFCCD4DC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
3223
Minor OS version
0
Major OS version
10
Entry point
4432
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wextract.pdb
advapi32
GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges
kernel32
_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetDriveTypeA
LoadLibraryExA
SetFileTime
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
GetVersion
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
GetExitCodeProcess
ExpandEnvironmentStringsA
LocalAlloc
lstrcmpA
FindNextFileA
GetCurrentProcess
FindFirstFileA
GetModuleFileNameA
GetShortPathNameA
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
GetDiskFreeSpaceA
MulDiv
FindClose
gdi32
GetDeviceCaps
user32
ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
GetDC
GetWindowRect
DispatchMessageA
GetSystemMetrics
CallWindowProcA
SetWindowTextA
MessageBoxA
SendDlgItemMessageA
SendMessageA
GetDlgItem
DialogBoxIndirectParamA
GetWindowLongPtrA
SetWindowLongPtrA
SetForegroundWindow
ReleaseDC
EnableWindow
CharNextA
LoadStringA
CharPrevA
EndDialog
MessageBeep
ExitWindowsEx
SetDlgItemTextA
CharUpperA
GetDesktopWindow
PeekMessageA
GetDlgItemTextA
msvcrt
?terminate@@YAXXZ
_commode
_fmode
_acmdln
__C_specific_handler
memset
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
memcpy_s
_vsnprintf
_initterm
memcpy
comctl32
ord17
cabinet
ord20
ord21
ord23
ord22
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=30795,
count=3, id=259, version=30795,
count=19, id=260, version=30795,
count=17, id=257, version=30795,
count=160, id=1, productName=Unmarked objects,
count=10, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,