Adv(0d)-MetaBase-(Zer0-D4y).zip
- SHA256 e41681239238870476e94cf0b6e00ff57a66850a058a2049b5a544c2a7c6a6c2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Adv(0d)-MetaBase-(Zer0-D4y).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
900 seconds
Behavioral task
behavioral2
Sample
Metabase-0day.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral3
Sample
pytransform/__init__.py
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral4
Sample
pytransform/__init__.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral5
Sample
pytransform/_pytransform.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
General
- Target Adv(0d)-MetaBase-(Zer0-D4y).zip
- Size 444KB
- Sample260815-tskzaazxgz
- SHA256 e41681239238870476e94cf0b6e00ff57a66850a058a2049b5a544c2a7c6a6c2
- MD5 08fc160788c4ccc784d35bd416696fd6
- SHA1 c7bafc987d480ab599f6c9ab703a6928728e17d2
- SHA512 ca6072a90f3c8f3b99727e33d18288cb394a84e3cac314138fa261ceace27ecec0d567e59f816a2d9ca1c0cc0379b3ea97303641bc6da624874257b15b15c061
- SSDEEP 6144:jP5G5hqt0QEENqywP9uUfrAxQaP+ov9pX1ZEwmVxZnQMo4+CiK3FStse3LSfCnur:jUhENfwuIyG+iJ7ZnXo4+/K3FSt742ur
- TLSH T158A4239D0BB9650CAA9F54726162EEFB80E5CCE7030AB917B1D49017C8A758D32D0FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/pytransform/_pytransform.dll
File Explorer
-
Adv(0d)-MetaBase-(Zer0-D4y).zip.zip 444KB
-
Metabase-0day.py.py .sh 39KB
-
pytransform/__init__.py13KB
-
pytransform/__init__.pyc19KB
-
pytransform/_pytransform.dll.dll 1.3MB
Metabase-0day.py
- SHA256 a4a21f6949b9d5d02cd8de29ce7de24ba9a61134bf97ffca20fb8622a1aa4dfe
- MD5 faccc2ca1513e15d80212bc86e4ef6bb
- SHA1 aff6c69b1de16e7d71647c07b7589d2a0fab74d9
- SHA512 05fab3d16a35eb89228290a2293ef34433ac6ec16a3b0dd478269efc1050de00d45d47b367f3cdd35aa5c87c0152ab61643ebf8a9ca9bc6967fdd376833ceda2
- SSDEEP 768:0K0USZUryHZkwcBZL59GoDaNAoLTwMFORN09U+7vaUWQWIezvtDtf6eijXkXFoQa:D0LZbHZfcrGoONAYTwMFORNuUVUWQLyw
- TLSH T1B603B8C55221D16F578E8D072E467BCC2878D1AFD5C9A302E0D4AA4FA4BC26BD5E8FC1
- MD5 SHA1 SHA512 SSDEEP TLSH
pytransform/__init__.py
- SHA256 380c08b75906042d18e73b0d2654eb03043098984caa27ab454548fd93a3aa08
- MD5 58eb86eef7db4dd2a4e2ec8f52bd7521
- SHA1 858e8e7966a3c1756be1df24c81673b2c5e8e288
- SHA512 f0938d52fb19df5263302abba8ef9af1a4e0e80a40e7415ff82a5ab3c260eec251eeb890d0ececba7044b7d86c3b67da5b6499dce05ec8ddf591d162d29c6aa0
- SSDEEP 192:sIRqMEqbHCTMRNpyRW3T+3JbgDIFRuJFX9d1X2wiQvZh7kELPJdhGbc8/SHRl3RJ:sFwfIuXFXZNjlh8c
- TLSH T1CF525F414C52B0229713D71B68D38658D76EA9538A0568BDBDDC81A8BF8046CC3FDFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
pytransform/__init__.pyc
- SHA256 c3f61f3acc3a30bab418d0d22a1fcb1a601def43241d7ccff733efc7b264e07f
- MD5 7de5a4d69445eef12a92998dd3b30d68
- SHA1 c37f0930fd6a4005a16bf670ac460bc6f29d18ff
- SHA512 1a18d2c2bf4ea14112a671e87464f2e2d8db11190afe296515e8b7fa57c60633f129b041308045fdbf4ef87cf625bf4d35841cd7d4f51aa8f8d66d682c11c13b
- SSDEEP 192:jmufKf6kF5y+vtmmmi3G6NmHKJNcAcCajjbG+CRWluntWBVe/yLCiMkmnCT29Qzq:CRlF/d3TNLh4bGRWlutWQAwC0
- TLSH T17792FCC4A3A2C84BCCB0117955F1025A5E76FAB376D307022B7F98BB549C75CC4AD3A6
- MD5 SHA1 SHA512 SSDEEP TLSH
pytransform/_pytransform.dll
- IMPHASH 73d87de363904907d618693dbd079b7f
- SHA256 d66c934fa2d5769d13e13fa80a079460e37b111277557f50d0c7f6effc41939a
- MD5 b0ff582c5cfefb1b57fb10cc396e4229
- SHA1 7a47b833d6ae4243eaf39f9e107d81a4d35a6c62
- SHA512 2ab3213a411d783b7254d6c8a09bf00858699f8aa5e872a120e6da246faaf0c63708452189a015ff7dac5ad146b3f1faaf37728fc60252b4f5b4f8af43c2bd49
- SSDEEP 24576:4b3t63f54CGqLkHmJFZVyOFP6WH9AkhzWoJaJSOjblM8hjvZWipWAZj2MflLreuM:66rQHmKnLRhc
- TLSH T12D55D52AF7DB01F1C52E2C3560A6A33B1A3D31C1513F5E429B54AE9BE6DF20059E8772
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
iphlpapi
GetAdaptersAddresses
GetNetworkParams
kernel32
CloseHandle
CreateFileA
CreateFileMappingA
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FlushViewOfFile
FormatMessageA
GetCurrentThread
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetThreadContext
GetVersion
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedExchange
IsDBCSLeadByteEx
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LocalFree
MapViewOfFile
MultiByteToWideChar
SetThreadContext
Sleep
TlsGetValue
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
WideCharToMultiByte
msvcrt
_access
_strdup
__dllonexit
__mb_cur_max
_assert
_errno
_flsbuf
_get_osfhandle
_iob
_isctype
_pctype
_snprintf
_stat64
_time64
_waccess
_wfopen
abort
atof
atoi
calloc
clock
exit
fclose
fflush
fopen
fprintf
fputc
fread
free
fseek
ftell
fwrite
getenv
isprint
isxdigit
localeconv
malloc
memcmp
memcpy
memmove
memset
qsort
rand
realloc
setlocale
sprintf
srand
strchr
strcmp
strerror
strlen
strncmp
strncpy
strrchr
strstr
toupper
vfprintf
wcslen
user32
wsprintfA
ws2_32
inet_ntoa
assert_armored
clean_obj
encode_capsule_key_file
encrypt_code_object
encrypt_files
encrypt_project_files
exec_file
generate_license_key
generate_project_license_files
get_error_msg
get_expired_days
get_hd_info
get_registration_code
import_module
init_module
init_runtime
set_option
show_hd_info
version_info
Name
.text
Size
773KB
Virtual Size
772KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
383KB
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
555B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ