dd644a4cac65e4f0923a2a221125ffd186fc51e5c08f7e3dae4e4db3496155b5
- SHA256 dd644a4cac65e4f0923a2a221125ffd186fc51e5c08f7e3dae4e4db3496155b5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cmd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
cmd.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target dd644a4cac65e4f0923a2a221125ffd186fc51e5c08f7e3dae4e4db3496155b5
- Size 122KB
- Sample260820-p8e1rade52
- SHA256 dd644a4cac65e4f0923a2a221125ffd186fc51e5c08f7e3dae4e4db3496155b5
- MD5 1c49eb463c833dea4645d79baa2b40b5
- SHA1 75b86bba3710d0d558ccee1307c56c8f93582226
- SHA512 fad36c4334901c3445703e3d4b075c0e817600a4f119f0d203bbae6054d7589aeaefc020b18db10b63e01922195192b1981acaf7f8c7528afbdeac33bc338b4c
- SSDEEP 3072:6zStm5B/aHeusm1b0pLIg8t8OUz3Fr0cdBdxBSq5va9g04wgg:gSa/aH51b0NIgzFrEd9g04wp
- TLSH T10CC31289B3F2CA61F4C0BAF14A138D335E4BE6B739705CB07D2850EE359AB58374121A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cmd.exe
File Explorer
-
dd644a4cac65e4f0923a2a221125ffd186fc51e5c08f7e3dae4e4db3496155b5.zip 122KB
-
cmd.exe.exe 352KB
cmd.exe
- IMPHASH 77aed1adaf24b344f08c8ad1432908c3
- SHA256 54899c24cf4075554432f369626956fcdad2cfffd2307a3e6b52c915e4274aae
- MD5 c50d5a81a6e758200e66e44e099e0655
- SHA1 06d0a1ce87044d81ae654202614a3b9a8ee0cab2
- SHA512 cdd34302d01c8b0bba4e32747e2e8f00bfd305787d3c072ad0da3f9d30a3a7e070fe98502f84223f800af17c41ed6eb48089b9a535d883559a2792ebb4cf5e36
- SSDEEP 6144:Tkknw6IdOrtDbUngzrlzMA32rOZT+zDwSMm:AaHIArtDbUngzBMA3GOZSzDwL
- TLSH T1DF747B6AB75050F6C1678278CC67C232D6B1BEAD4760670F86D4CEAB3F32626672C705
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
3
Major OS version
6
Entry point
28192
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
cmd.pdb
msvcrt
_iob
rand
printf
fprintf
wcsrchr
_wcsupr
setlocale
_wpopen
_wcsnicmp
_vsnwprintf
_errno
wcstoul
iswalpha
iswdigit
_local_unwind
_setjmp
memcmp
ferror
memcpy
memset
realloc
feof
?terminate@@YAXXZ
_commode
_wcsicmp
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
iswspace
wcstol
_get_osfhandle
_exit
__set_app_type
__getmainargs
wcschr
memmove
_amsg_exit
_XcptFilter
_getch
calloc
free
towupper
_wcslwr
qsort
_dup2
wcsspn
_dup
towlower
fgets
longjmp
wcsstr
_tell
_pclose
_close
_open_osfhandle
swscanf
_ultoa
_pipe
wcsncmp
_setmode
exit
iswxdigit
time
srand
_wtol
fflush
wcscmp
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtOpenThreadToken
NtClose
NtOpenProcessToken
NtQueryInformationToken
RtlFreeHeap
NtFsControlFile
RtlDosPathNameToNtPathName_U
RtlFindLeastSignificantBit
RtlFreeUnicodeString
RtlReleaseRelativeName
NtOpenFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetInformationFile
NtQueryVolumeInformationFile
NtSetInformationProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtCancelSynchronousIoFile
RtlCreateUnicodeStringFromAsciiz
api-ms-win-core-kernel32-legacy-l1-1-1
CopyFileW
api-ms-win-core-memory-l1-1-2
VirtualQuery
VirtualFree
VirtualAlloc
ReadProcessMemory
api-ms-win-core-localization-l1-2-1
SetThreadLocale
GetCPInfo
GetACP
FormatMessageW
GetLocaleInfoW
GetUserDefaultLCID
GetThreadLocale
api-ms-win-core-console-l1-1-0
SetConsoleMode
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetConsoleCtrlHandler
WriteConsoleW
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleW
api-ms-win-core-file-l1-2-1
GetFileSize
RemoveDirectoryW
FlushFileBuffers
SetFilePointer
GetFullPathNameW
GetFileAttributesW
FileTimeToLocalFileTime
CompareFileTime
WriteFile
FindFirstFileW
CreateFileW
GetFileType
SetFilePointerEx
CreateDirectoryW
GetVolumeInformationW
SetFileAttributesW
GetDiskFreeSpaceExW
SetEndOfFile
GetDriveTypeW
GetFileAttributesExW
DeleteFileW
SetFileTime
FindNextFileW
FindFirstFileExW
ReadFile
GetVolumePathNameW
FindClose
api-ms-win-core-errorhandling-l1-1-1
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
MultiByteToWideChar
api-ms-win-core-processenvironment-l1-2-0
GetCurrentDirectoryW
SetEnvironmentVariableW
GetCommandLineW
SearchPathW
GetEnvironmentVariableW
GetStdHandle
GetEnvironmentStringsW
SetEnvironmentStringsW
ExpandEnvironmentStringsW
FreeEnvironmentStringsW
SetCurrentDirectoryW
NeedCurrentDirectoryForExePathW
api-ms-win-core-console-l2-1-0
FillConsoleOutputAttribute
SetConsoleTextAttribute
SetConsoleTitleW
FlushConsoleInputBuffer
GetConsoleTitleW
SetConsoleCursorPosition
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
ScrollConsoleScreenBufferW
api-ms-win-core-heap-l1-2-0
HeapReAlloc
HeapSetInformation
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
api-ms-win-security-base-l1-2-0
GetFileSecurityW
GetSecurityDescriptorOwner
RevertToSelf
api-ms-win-core-synch-l1-2-0
EnterCriticalSection
TryAcquireSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockShared
ReleaseSRWLockShared
WaitForSingleObject
Sleep
InitializeCriticalSection
ReleaseSRWLockExclusive
api-ms-win-core-sysinfo-l1-2-1
GetLocalTime
GetSystemTime
SetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetVersion
GetWindowsDirectoryW
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
SystemTimeToFileTime
api-ms-win-core-datetime-l1-1-1
GetDateFormatW
GetTimeFormatW
api-ms-win-core-systemtopology-l1-1-0
GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx
api-ms-win-core-processthreads-l1-1-2
GetCurrentProcessId
InitializeProcThreadAttributeList
GetCurrentThreadId
TerminateProcess
UpdateProcThreadAttribute
GetExitCodeProcess
GetStartupInfoW
ResumeThread
CreateProcessAsUserW
CreateProcessW
OpenThread
DeleteProcThreadAttributeList
GetCurrentProcess
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyExW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
api-ms-win-core-file-l2-1-1
CreateSymbolicLinkW
CreateHardLinkW
MoveFileWithProgressW
MoveFileExW
GetFileInformationByHandleEx
api-ms-win-core-io-l1-1-1
DeviceIoControl
api-ms-win-core-processtopology-l1-2-0
GetThreadGroupAffinity
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpW
lstrcmpiW
api-ms-win-core-heap-obsolete-l1-1-0
GlobalAlloc
LocalFree
GlobalFree
api-ms-win-core-processtopology-obsolete-l1-1-0
SetProcessAffinityMask
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
DelayLoadFailureHook
Name
.text
Size
176KB
Virtual Size
176KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
332B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.qtinj
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=54, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=207, version=65501,
count=2, id=205, version=65501,
count=265, id=1, productName=Unmarked objects,
count=9, id=203, version=65501,
count=22, id=206, version=65501,
count=37, id=215, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,