aria2.zip
- SHA256 19c2967a309c02ea08ac9e098b6f53675fd100c9c4cb87d4a6f412703bef071b
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
aria2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
aria2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
aria2c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
aria2c.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target aria2.zip
- Size 1.7MB
- Sample260822-gybatafk6w
- SHA256 19c2967a309c02ea08ac9e098b6f53675fd100c9c4cb87d4a6f412703bef071b
- MD5 204e8d23fd24b0898e8076fbf3e6523a
- SHA1 1c6c7bee581802b61efad7f73235faa6d201cbd5
- SHA512 3426e5a3b0f769424ffe157962dedabbaa521396dffb4ac0d7404d5f38011b55af02a5d1d48b91407d9d81c8ee4ef50741fa33db386c0c93d3f19847f776f1e8
- SSDEEP 24576:DdLSD5ohUp9I2XZ5gRSE0OW5jL92yi1wcHEtY9EzQTjtSLBbHw:x7gD5YSEQ5E1Uiuz65SLBbQ
- TLSH T1048533BAFFB4C45E933AC76B6D4E4AF33A723F9D50A9C0C854A0D7C944C557B284A842
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/aria2.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/aria2c.exe
File Explorer
-
aria2.zip.zip 1.7MB
-
README.md547B
-
aria2.conf3KB
-
aria2.exe.exe 16KB
-
aria2c.exe.exe 3.8MB
README.md
- SHA256 8b1ffb201d4dc5e49fd5f5db39a9e12816ce95e895fba5360225ede1708f7f42
- MD5 24340080323174f27855c26571d2a3d1
- SHA1 28d7c55dddf3c4d29b88ec1df31274fea2748552
- SHA512 a3c017479b132ec777994039b88d4216d45451171f3e40aa7199ba890cac278fcc48627a35ff28a815962d371622821baa123d1d2b67854889764b174b7ca3c1
- TLSH T187F0C9D83F1F1F013002C1A12738103CF28A8006FBDE305474DA82D95F79B0802ACD12
- MD5 SHA1 SHA512 TLSH
aria2.conf
- SHA256 7164e9149c279ad25a2a12687f171fffe7ad4e43c147e7caada183ec306b6df3
- MD5 1057657f211899b9cf2cf6c4763590cd
- SHA1 93ebae872c61b7a66359e7a85723422de2a1e649
- SHA512 99bcb86ac60bf0772b7423998ba06866eb24b4f3dd1172d09c55984996101cf23bf090e0f698a3eb6f10dee48c250b677f59e402f125a0672d509f1ec2144623
- TLSH T19C61B8DDAF7DB9F5724FA3B13E9CE2E2721525D79C2DA4959C90020CE54A60B0274F42
- MD5 SHA1 SHA512 TLSH
aria2.exe
- IMPHASH 1ad88f29b3f2e97e57f32b98c058b515
- SHA256 af2f0607d25e45251e58a4a5ce6bb0d1397faa334f963cb2208529698df11c17
- MD5 867a500cec870b8d3bea3ae536539c22
- SHA1 9c2a8902612074bdbfabbe80d7808366b71865df
- SHA512 4d8589e11813fcc75879f03ddc651216887d7f2d270c109875132803c290ddc617a3dd95e2edbea0ba892f1de74dd5fb3c1f34aea31ea1fb9c284ceee7a9bd5d
- SSDEEP 192:SBxYNapkZ0+PoOMeF9wAndgMnzmE6HPmoynvXUUN4aHcdvIzZcM:+xaHZlgq9pzmXm9Xdt8dvu1
- TLSH T1BB721C5196E4E054F37535702771E63A225DFC6D0E33C9AA982FF2B86D3535C5C2221E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
67:e5:19:97:92:b3:58:07:7e:77:3d:0f:b7:f7:96:d0:1e:80:73:28
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
4
Entry point
6374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
GetModuleHandleW
lstrlenW
lstrcpyW
SetCurrentDirectoryW
GetModuleFileNameW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetConsoleWindow
AllocConsole
CloseHandle
ExitProcess
CreateProcessW
Sleep
TerminateProcess
OpenProcess
SetConsoleTextAttribute
GetStdHandle
GetStartupInfoW
user32
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorW
MessageBoxW
DefWindowProcW
IsWindowVisible
PostQuitMessage
SetWindowTextW
SetTimer
LoadStringW
CreateWindowExW
ShowWindow
UpdateWindow
CreatePopupMenu
AppendMenuW
GetCursorPos
TrackPopupMenu
PostMessageW
SetForegroundWindow
DestroyMenu
LoadIconW
RegisterClassExW
msvcrt
wcschr
memset
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
_wtoi
wprintf
_iob
_wfreopen
wcstok
_vsnwprintf
wcsrchr
shell32
Shell_NotifyIconW
psapi
GetProcessMemoryInfo
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=19, version=9049,
count=11, id=10, version=8047,
count=2, id=14, version=7299,
count=2, id=4, version=8047,
count=7, id=19, version=8034,
count=68, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
aria2c.exe
- IMPHASH fe72a6f9785b2ba00165f2881de4c777
- SHA256 ff68931f360dbe32ac29c73bb4154cf6a7a5628ea8e586cbf5f259c6f0ccc480
- MD5 497caed51689e3b12111dbedffea237f
- SHA1 af4b619eaa80e6cc005255d19f75cd41b18f8ef9
- SHA512 94442578fea85e84bdbcb3188a0b16a3604a20a989a35a6a88d277a877ae1351b424eaa2724629da25fb427a0efdc40cbb42bac65b9c47087c0814090abd29d2
- SSDEEP 98304:XYSGGLYCuY+1i92Eav4WvrpWuusctAyp5YGJN:X1dLYCuJ54WvrpFu7trYGJ
- TLSH T118163B19E78385F6D92305F15507EBBFAA205B358020CC6FF28CDE98EBB2D926519317
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5344
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
PFXImportCertStore
PFXIsPFXBlob
iphlpapi
GetAdaptersAddresses
kernel32
AreFileApisANSI
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateSemaphoreA
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExpandEnvironmentStringsA
FileTimeToSystemTime
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCommandLineW
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetHandleInformation
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessTimes
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadPriority
GetThreadTimes
GetTickCount
GetTimeZoneInformation
GetVersionExA
GetVersionExW
GetWindowsDirectoryA
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseSemaphore
ResetEvent
ResumeThread
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetCriticalSectionSpinCount
SetEndOfFile
SetEvent
SetFilePointer
SetFilePointerEx
SetLastError
SetProcessAffinityMask
SetSystemTime
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
__argv
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fmode
_fstat64
_ftime
_initterm
_iob
_lock
_lseeki64
_onexit
_setjmp3
_setmode
_snwprintf
_wstati64
time
localtime
gmtime
_stricmp
_strnicmp
_unlock
calloc
clock
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwprintf
fwrite
getc
getenv
getwc
islower
isspace
isupper
iswctype
isxdigit
ldiv
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
perror
printf
putc
putwc
qsort
raise
rand
realloc
setlocale
setvbuf
signal
sprintf
srand
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncmp
strncpy
strtol
strtoul
strxfrm
_vsnprintf
_waccess
_wfsopen
_wgetcwd
_wmkdir
_wopen
_wrename
_write
_wrmdir
_wsopen
_wunlink
_wutime
abort
asctime
atoi
tolower
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcscpy
wcsftime
wcslen
wcstombs
wcsxfrm
_snprintf
longjmp
_tzname
_write
_tzset
_strdup
_read
_open
_isatty
_fileno
_fdopen
_dup
_close
secur32
AcceptSecurityContext
AcquireCredentialsHandleW
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
QueryContextAttributesA
shell32
CommandLineToArgvW
user32
MessageBoxW
ws2_32
WSACleanup
WSAGetLastError
WSASend
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
360KB
Virtual Size
360KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE