MALU6.rar
- SHA256 07d98c1a6c026f4531854155c2a0f7927f2095731194a89f5c36885394df9874
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MALU6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
MALU6.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
MALULER.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
MALULER.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target MALU6.rar
- Size 7.9MB
- Sample260824-gynadacc49
- SHA256 07d98c1a6c026f4531854155c2a0f7927f2095731194a89f5c36885394df9874
- MD5 82a87981360925b52242940e86e3fcf7
- SHA1 77ecf20f873905b5157f1e2e2f339483ca17ca93
- SHA512 827e869b194d6107fa1668bd5d07575ce618e71064a240bda0431f056a56daf688b6d1b015a3267238e65b89e8d3931cbcc575e3da2eb6f9a7c96901377133fe
- SSDEEP 196608:qyJOXSy7U+0TV7q3WQO1s0dUx1oG9nYMVE9HHUCvyqRb:rJOxdaVg3Ss0uSGzEtUob
- TLSH T1728633A29BD4BE71E015CF761F075596F843D5F39EC85EA1E300A843A9E93077239382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/MALU6.exe unpack001/MALULER.exe
File Explorer
-
MALU6.rar.rar 7.9MB
-
MALU6.exe.exe 6.4MB
-
MALULER.exe.exe 2.2MB
-
config.json201B
MALU6.exe
- IMPHASH 79b3362178937bf9559741c46bb9e035
- SHA256 ee7f6a902485fc36035afc2a9507ea65160e65da868e2df37d0b1176155cc419
- MD5 88705b8d04202e4edf007b89d89b755b
- SHA1 72a0e5303ced3514f1317ef1059b601af0adc4f2
- SHA512 2e1c7e70f2b1dcf12270e8ebf7ef284d791eb8172fcad13f7bc10784fcd2d3dca47caa7681e4bf29a3b5500eaaca222d3db6cf3cb42384bc33b8fed8e4935bd1
- SSDEEP 196608:DyJOXSy7U+0TV7q3WQO1s0dUx1oG9nYMVE9:2JOxdaVg3Ss0uSGzE
- TLSH T14A663312DBD8EEB1A0098E3B1B0B4495F443DAE35EC89EA1E304E84B79EC757B139745
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
0
Entry point
17449093
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
GetModuleHandleA
GetProcAddress
Name
Size
6.4MB
Virtual Size
16.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
MALULER.exe
- IMPHASH a5b6b3cd429d24e736735883ca28425b
- SHA256 3c1d9ca5881c3a3280643dffc6c96e14a2e568c9ad3fbada7de61d7dcc93a9f9
- MD5 426ce2fbf547487b78cf24be3d749b08
- SHA1 6648d94be35569bb661eee6e919dcfab8d02e345
- SHA512 e351bd3c40941f40539cb9264d0d0f60ce133cd4de2f7185b68cfbd3288b6580c49aa4612db3ef8ac0d9bb87b5bc38161fdd7bd02adbf972ab51c752796536c5
- SSDEEP 49152:HElFcXna/H2HQT3RCmHPO7RUOah7r3Br7zDLvQVL0Or/+8ac6gj:AF9RVvO/anX3LIVLVrl3j
- TLSH T1B1B59E4AE6A502E9DC7AC039CC6E665AF87074D68B7047F742518F7B1F223E1A93E350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
326248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
MulDiv
GetSystemDefaultLangID
ReadProcessMemory
GetCurrentProcessId
VirtualProtectEx
GetProcAddress
GetSystemDirectoryW
GetVersionExW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
WritePrivateProfileStringW
IsBadReadPtr
WideCharToMultiByte
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetExitCodeProcess
WaitForSingleObject
Sleep
DeleteFileW
CreateThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
DeleteCriticalSection
RaiseException
SetLastError
FlushInstructionCache
GetCurrentProcess
lstrcmpiW
CompareStringW
FreeLibrary
LoadLibraryExW
WriteConsoleA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
SizeofResource
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
MultiByteToWideChar
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
HeapReAlloc
HeapCreate
HeapSetInformation
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
GetStartupInfoW
HeapAlloc
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
WriteConsoleW
GetConsoleOutputCP
SetEndOfFile
GetProcessHeap
LoadResource
LockResource
OutputDebugStringW
CreateFileA
InterlockedPushEntrySList
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
CreateProcessW
GetLastError
VirtualAllocEx
WriteProcessMemory
LoadLibraryW
QueueUserAPC
ResumeThread
TerminateProcess
CloseHandle
LockFile
GetFileSize
ReadFile
UnlockFile
lstrlenA
DebugBreak
CreateFileW
MoveFileExW
WriteFile
GetModuleHandleW
SetFilePointer
FindResourceW
lstrlenW
GetCommandLineW
GetStringTypeW
LocalFree
user32
CreateWindowExW
GetDlgCtrlID
SetWindowLongW
GetWindowTextLengthW
SystemParametersInfoW
GetClassNameW
GetFocus
GetSysColor
IsWindowEnabled
FillRect
DrawFocusRect
SetWindowLongPtrW
GetWindowLongPtrW
CallWindowProcW
OffsetRect
LoadCursorW
ScreenToClient
GetCursorPos
GetCapture
ReleaseCapture
SetCapture
PtInRect
SetCursor
InvalidateRect
CreateDialogParamW
EndDialog
DialogBoxParamW
IsWindow
SetRectEmpty
DestroyWindow
DefWindowProcW
MessageBoxW
PostQuitMessage
CheckDlgButton
ClientToScreen
TrackPopupMenu
IsDlgButtonChecked
GetActiveWindow
UpdateWindow
GetParent
GetWindow
GetWindowRect
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
LoadMenuW
GetSubMenu
GetSystemMetrics
LoadImageW
RegisterWindowMessageW
IsDialogMessageW
GetClassInfoW
RegisterClassW
ShowWindow
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharLowerW
PostMessageW
wsprintfW
AppendMenuW
CheckMenuItem
GetDlgItem
ModifyMenuW
SetWindowTextW
SetDlgItemTextW
BeginPaint
SetRect
DrawTextW
EndPaint
GetWindowTextW
EnumChildWindows
ReleaseDC
GetDC
SendMessageW
CharNextW
CharUpperW
LoadStringW
SetFocus
UnregisterClassA
gdi32
GetObjectW
GetStockObject
CreateFontIndirectW
DeleteDC
SelectObject
SetTextColor
CreateFontW
DeleteObject
EnumFontFamiliesExW
GetDeviceCaps
SetBkMode
comdlg32
ChooseFontW
GetOpenFileNameW
advapi32
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
shell32
CommandLineToArgvW
ShellExecuteW
ole32
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
oleaut32
SysAllocString
SysFreeString
VarUI4FromStr
shlwapi
SHGetValueW
SHSetValueW
PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameW
comctl32
_TrackMouseEvent
InitCommonControlsEx
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Name
.text
Size
396KB
Virtual Size
396KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=150, version=20413,
count=10, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=23, id=123, productName=VS2005 build 50727, version=50727,
count=271, id=1, productName=Unmarked objects,
count=132, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=88, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
config.json
- SHA256 002bd7dfeb3fa4635d231e361e41962f4047487a377d3355993227dfc08e50b5
- MD5 78974c52e45a566f710a442bf55429bb
- SHA1 9ebef8985ad3cee77135d0c34defa3376abe02d3
- SHA512 c485bde3c1402d43c2f93e25c8b9e7ccba6808c75ae72377ff3dc37ccfd1f3b990cd893929a638c4853a690909a7f336443f9f53727e0c90532414a755c74f5b
- TLSH T1C8D01247CC490C635698F4745D212367341432136A48B70CB344945E0F9B8396AE6116
- MD5 SHA1 SHA512 TLSH