25082026_1523_25082026_F İYAT.r00
- SHA256 fe3c2e6a20a97988bc64bdc523030748f604f541bb402b48b3bf4910e719af24
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FİYAT.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral2
Sample
FİYAT.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
300 seconds
General
- Target 25082026_1523_25082026_F İYAT.r00
- Size 540KB
- Sample260825-sstezsvblh
- SHA256 fe3c2e6a20a97988bc64bdc523030748f604f541bb402b48b3bf4910e719af24
- MD5 bb1419b497c10158bce51b212c205769
- SHA1 c14ed269de661466940adf6de9a02897894faa5f
- SHA512 2863f49736a79f6ac0546d66b6f991324489f4f0b982697ad7ca66319dc5d922455948744a59eeb86732ca3fa163762c17beb9cc58978f4a19e127a7d9f63bd2
- SSDEEP 12288:rsWO8EVg8Tpux/5aS1MucQnS69D8GyXOP70x5OoIM:yRVgld5aS1Mur78GgOj0AM
- TLSH T182C42380079F98DAF0718984A3FA5FED6244F149D52674DA8CFCA26ACBF6317CD5180E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FİYAT.exe
File Explorer
-
25082026_1523_25082026_F İYAT.r00.rar 540KB
-
FİYAT.exe.exe 1.2MB
FİYAT.exe
- IMPHASH aff49c8e3178cf6bff89b55da167fda4
- SHA256 c516aacac2686547b0261c0612b5c8085390b6736c71ad3e90e2f855c8709e2a
- MD5 58458c8769daca288527b1d1af95cbf1
- SHA1 13c2663c15a2c27789686730a1b52e2ddffbef22
- SHA512 296f128f853767fd46d49e41bf0727a5c0afdd2fe906d97cbd60aba16049a891178d5a46a20b28c196d9522874188ba53890807f9f882bda7ba4aadbdf52fb7e
- SSDEEP 24576:rIXX/qaaXPpP732gvVVIF+ds/0bVbhS1oDs90AdH:rQX/qr2F+i0bNhS3H
- TLSH T17F45AE19E3D942F8E523D234CBA65232E77178060365B9EB0799EA152F73ED06B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
313104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
RegisterEventSourceW
ReportEventW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
bcrypt
BCryptGenRandom
kernel32
GetFileSizeEx
RtlPcToFileHeader
CloseHandle
CompareStringEx
CompareStringOrdinal
CreateEventExW
DuplicateHandle
FindNLSStringEx
FindStringOrdinal
FormatMessageW
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessorNumberEx
GetCurrentThread
GetEnvironmentVariableW
GetLastError
GetLocaleInfoEx
GetModuleFileNameW
GetStdHandle
GetThreadPriority
LCMapStringEx
LoadLibraryExW
LocalFree
LocaleNameToLCID
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
QueryUnbiasedInterruptTime
RaiseFailFastException
ResolveLocaleName
SetEvent
SetLastError
SetThreadErrorMode
Sleep
SleepEx
VirtualAlloc
VirtualFree
WaitForMultipleObjectsEx
WideCharToMultiByte
WriteFile
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
IsProcessorFeaturePresent
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleMode
SetFilePointerEx
CreateFileW
WriteConsoleW
RaiseException
AddVectoredExceptionHandler
RtlRestoreContext
VerSetConditionMask
ResetEvent
WaitForSingleObjectEx
CreateEventW
SwitchToThread
CreateThread
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
CreateMemoryResourceNotification
QueryInformationJobObject
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
LocateXStateFeature
SetXStateFeaturesMask
VirtualQuery
DebugBreak
WaitForSingleObject
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
FlushProcessWriteBuffers
InitializeCriticalSection
EncodePointer
RtlUnwindEx
ntdll
RtlGetCurrentPeb
ole32
CoInitializeEx
CoWaitForMultipleHandles
CoUninitialize
CoGetApartmentType
Name
.text
Size
839KB
Virtual Size
839KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
250KB
Virtual Size
250KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=11, id=257, version=33145,
count=171, id=1, productName=Unmarked objects,
count=9, id=259, version=35729,
count=8, id=260, version=35729,
count=150, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=48, id=261, version=35721,
count=1, productName=Unmarked objects (old),
count=69, id=261, version=35729,
count=1, id=256, version=36252,
count=1, id=258, version=36252,