DiscountStore.zip
- SHA256 bb7f5ac3259e25ead9fcfc143a990a83a9c4a4f413e29f56bee9060f05d86052
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DiscountStore.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
DiscountStore.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
DiscountStore.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
DiscountStore.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target DiscountStore.zip
- Size 6.3MB
- Sample260818-rm9pcavwfv
- SHA256 bb7f5ac3259e25ead9fcfc143a990a83a9c4a4f413e29f56bee9060f05d86052
- MD5 378f8da1a97282847f76111d2a314e89
- SHA1 adc115d4a7b86f3a51c4140841ae4d370f9f630a
- SHA512 381734f7e4dea63ab15bcb4eecb53e536d2ffe282b4dbf9217ff09c15e3306020ec2b2e0f10a2d95ac0a4136704074a810a4c748416fa7cfe4cfd9ed3c9e6996
- SSDEEP 196608:cJV3QraCU7nDIYLVwLvMdzCtT8e3GAomLZqvACYsdL:cvQrvSTLVwTMYFX2AoAAoBoL
- TLSH T1AE66339ED0D0C903AF93A0FEF52BBA04385F57096FA4752E279ED49351138EA2F6D448
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/DiscountStore.dll unpack001/DiscountStore.exe
File Explorer
-
DiscountStore.zip.zip 6.3MB
-
DiscountStore.deps.json431B
-
DiscountStore.dll.exe 6.3MB
-
DiscountStore.exe.exe 377KB
-
DiscountStore.runtimeconfig.json429B
DiscountStore.deps.json
- SHA256 667dfc887645233c1b56836273c45fa7eb740d7d24847235968a0de0160be9b5
- MD5 83c7a5ff080bfa74797e458902e8804d
- SHA1 3b4a1bec9789727f2b90bed4e9d2f53a204d04da
- SHA512 e193f06c6d5388c603577fe45278310623d57ebc61c6ad6d566911e90744507fb2a1566b58f7b0aacfcb36be0291c23bdeb3616c4afc85b1206906e7fa55a731
- TLSH T1ABE09A29E5880C9B05F227B268378382F73257730121180AB9FEC11C4F7285B9412FBE
- MD5 SHA1 SHA512 TLSH
DiscountStore.dll
- SHA256 2687e9d6dfef578dfd0297b24594c9433d7eddb5066db055fe84f884c68c23cc
- MD5 61654b627e9345295e3c4c68447aac5a
- SHA1 6c9a0c861f959b0f991770b601493de80e91be46
- SHA512 c61a0620fb78058f8b97202fbc9fde5204a38b27cac2a2107b8053095d05cbd5601e9a7f75c77fd8e5d50dc8428b3321380e7a0baca84f8a02f84a6fb2dcd343
- SSDEEP 196608:Wzmhz9ULNrIu+0Rs7N4X3c6FWKBpKGAQyblajKA7qbw3C:Kmh5+l+0Rsh4EIppAQyUOAmbwS
- TLSH T1646633D87140A1DFCD63C0759F216C20652B2CBD9716620B3297F35A973ECA2CF1A6E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
6.1MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
230KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
DiscountStore.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 703fbcbee9cf5f61b9b2a35ca5393d37f409277e71932e272360f17e92cc4429
- MD5 4c3c8ae3ceff5edef1f47080b8317208
- SHA1 6b3269159db4fb94029718cf3c355d3c2ff619b6
- SHA512 e3fbfc451d380337b532f3d3f993caa9f0823b779aa991263a0b9a107a069236f39c131140ef04e42447b427b3adf5325ae6962effeae58efdf2535b372f8619
- SSDEEP 6144:E64k83TlEvSmIg9QVq4A00rz9F9FN1Xsewp/midvj8WJXT9390LZgeBjSbsc:E/TloSrA00rz9F9FN1cewBdr8GT93908
- TLSH T190846CC2B65480AAD4B655798F428C50A73F3CE98B60728B13D1F72A1F72E605E3F746
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
230KB
Virtual Size
230KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35217,
count=1, id=258, version=35217,
DiscountStore.runtimeconfig.json
- SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
- MD5 1043e1e5e960609d014e56f638202c24
- SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
- SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
- TLSH T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
- MD5 SHA1 SHA512 TLSH