260819.zip
- SHA256 a9c1c77717765c851243c2d680badacfe8f5a2657051105f94a1cbd25a0d3124
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
winhttp.dll
Resource
win10v2004-20260513-ja
windows10-2004-x64
22 signatures
600 seconds
Behavioral task
behavioral2
Sample
winhttp.dll
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
23 signatures
600 seconds
General
- Target 260819.zip
- Size 215KB
- Sample260819-kh6css1anh
- SHA256 a9c1c77717765c851243c2d680badacfe8f5a2657051105f94a1cbd25a0d3124
- MD5 760ab029563cb04d9084d4b181e50fd8
- SHA1 9967fe52055d7ba22a86ad9408157d12dc0be9a1
- SHA512 ecda6596fb8b4fddd3456811ef3e35d170c8d74dc41ff2f18109b3dab84c8a5307bf06e720d08e8cc1387ab633ad7dbb1f64f2b596d2a5c1086ffbe2be745b04
- SSDEEP 6144:7lLZzarF/MmnIdCgLAUNygsl9gLQylIfKbJ5:7hpaTmLAcsfgLQwIk/
- TLSH T171242361205F8E255D0A32A8FD89A4BFF3ED90D8BEC2A5D385245F4F42F814E494761F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack003/winhttp.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/winhttp.dll
File Explorer
-
260819.zip.zip 215KB
-
RKM-20260817-3684.7z.7z 215KB
-
RKM-20260817-3684/Open_to_view_6fe9.img.iso 456KB
-
Open_to_view.exe.exe 25KB
-
winhttp.dll.dll 379KB
RKM-20260817-3684.7z
- SHA256 c240b8b5400a53cae0401e1c38b5a61fd5796ce6ff74b90724de12c334e50d86
- MD5 64aa9007588bb2355a690545324ca34d
- SHA1 c2a584cdbc292baaf9b6dc3c54411fd60dc1783f
- SHA512 21b77a0925a14849702a6fb36c273f8cc0e03d1163a134260197fc8e6d9f165a4edc12e4802da10fcfd578178dadce72641facaef24bd78b8b3d2e3f731022b0
- SSDEEP 3072:4Z8mvWLNDR7R09FGXNtB/kY6YTliOGMORNFKdZeUeVELBoHhFvXDocpVC6DecGWQ:4TmDReyyYP7GnWcuBAXDVpV3TDOh
- TLSH T18B2412BC110D5D9F2C38BCA8BCE6BE724DA9F59372254B1DF8923691455C3AE13C805E
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
RKM-20260817-3684/Open_to_view_6fe9.img
- SHA256 f2fd18f2398ef28c671dc169910e910b54b7829dd350ff4ce3b2dfd76d9ada6a
- MD5 2eb9e3d04c1b6a4b28ce83c3c7d96888
- SHA1 983fb16d68fb1b8bcd9b30cd2c5b3d5f5cd6294a
- SHA512 c3c571c1301312acae25022450c4e37068fe153a44b4e86ae41d6fe77b5addb034cd5dbfec5976cf50ef64cf42305e85069b586bcb5b22bca62229457bb1e223
- SSDEEP 6144:7kJSj74GcEWPZtjdyrVISuKducwtXm7nq9Mz86uaLWKa:4JF5P1+uKdgXm7qsu
- TLSH T1DEA404A71066875EF953C2F46AD4A3E1EF7F7CB02A48465EE3CAEC2C0716549E6142F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Open_to_view.exe
- IMPHASH efbc5d32d2077e678dc0b30693365b4b
- SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
- MD5 e6363b8ec386338ce08f159a739f0e97
- SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
- SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
- SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
- TLSH T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
28:b5:61:e5:83:23:1a:d6:93:68:f0:42:ed:02:d7:01:f6:cb:0f:f2:5d:76:04:26:a4:89:a7:8e:67:0e:95:2d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 22, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:03:bd:d5:95:5d:0f:3b:18:ad:00:00:00:00:04:03
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ff:12:38:7c:f7:c1:65:d6:a1:00:01:00:00:01:ff
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
4336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\b\amd64\tls12-download.pdb
winhttp
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpOpen
wintrust
WinVerifyTrust
shell32
CommandLineToArgvW
kernel32
CloseHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
WriteConsoleW
WideCharToMultiByte
FormatMessageW
GlobalFree
GetModuleHandleW
GetStdHandle
GetCommandLineW
GetEnvironmentVariableW
CreateFileW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointer
WriteFile
IsProcessorFeaturePresent
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
TerminateProcess
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
396B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=259, version=34321,
count=1, id=261, version=34321,
count=5, id=260, version=34321,
count=9, id=257, version=33140,
count=42, id=1, productName=Unmarked objects,
count=1, id=260, version=34438,
count=1, id=255, version=34438,
count=1, id=258, version=34438,
winhttp.dll
- IMPHASH 30b9be7c12cf36a4122c6f56c26e52aa
- SHA256 e4c02c94811cd22086c1b1f1204cf8e9986474af829ab6bce4eb55038daf203b
- MD5 0eee0cdc6930dcd636277423fda07105
- SHA1 afbaf3eb4d6eaa6526a994ac4986c6daaa9b5261
- SHA512 5dcf90bb4b0c3f82e85fdaadd457679e3a1d78dd5454410bc3ad887e719f7650a25e64041b15f0041df2d492062d79bf819699bca37ddcc39628d85ea19420ac
- SSDEEP 6144:cSj74GcEWPZtjdyrVISuKducwtXm7nq9Mz86uaLWKax:cF5P1+uKdgXm7qsu7
- TLSH T12384F3A71066975EF953C2F46AD4A3E1EF7F7CB02A084A5EC7DAEC2C031654AD6142F0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
4288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapFree
GetProcessHeap
GetModuleHandleA
GetProcAddress
LoadLibraryA
HeapAlloc
DebugCreate
WinHttpCloseHandle
WinHttpConnect
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=33145,
count=6, id=1, productName=Unmarked objects,
count=3, id=260, version=35228,
count=2, id=259, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,