9918252057f8c43c8365070931979c6a5ec63639216cd883a271f5d0e4c9bf02.zip
- SHA256 9dc4fe630fb5d0a6e0b277fd01de01755c078282bac4926fff897262f7c28ca7
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9918252057f8c43c8365070931979c6a5ec63639216cd883a271f5d0e4c9bf02.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
9918252057f8c43c8365070931979c6a5ec63639216cd883a271f5d0e4c9bf02.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 9918252057f8c43c8365070931979c6a5ec63639216cd883a271f5d0e4c9bf02.zip
- Size 2.4MB
- Sample260825-wfhphadj4x
- SHA256 9dc4fe630fb5d0a6e0b277fd01de01755c078282bac4926fff897262f7c28ca7
- MD5 0967a974e5ccd89e37c9d009ab444a54
- SHA1 2ee135e9aaa52375385cb80f5f3ad04fd5dc9527
- SHA512 61ccd7bf5ca1cc94b63ae2319a994235dd20b09370413d565fd645c83e945bac37078e1c4429f12943c6ea2f32a5d351a6200005894d56b0fee99b4d117a569c
- SSDEEP 49152:hkhTNPALUoKd/L/4xylQ0vb1VfcD8ig5bGZjxwZfEFABSvLL:E5P+UoKt4xyW0vbPfk8ig5bIjxmfEik3
- TLSH T16AC533467B04DC95BBD8E93DC4FE050BE9484216889E3D0DE22EA10F50F1B495FBBE4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9918252057f8c43c8365070931979c6a5ec63639216cd883a271f5d0e4c9bf02
File Explorer
-
9918252057f8c43c8365070931979c6a5ec63639216cd883a271f5d0e4c9bf02.zip.zip 2.4MB
-
9918252057f8c43c8365070931979c6a5ec63639216cd883a271f5d0e4c9bf02.exe 4.6MB
9918252057f8c43c8365070931979c6a5ec63639216cd883a271f5d0e4c9bf02
- IMPHASH ee66c88d13dcaefb4c42f72d994bf597
- SHA256 9918252057f8c43c8365070931979c6a5ec63639216cd883a271f5d0e4c9bf02
- MD5 08acc39a83ab8a33e01359178019d949
- SHA1 a1ff90db5a3b689a225c71a893d6d626701ed36d
- SHA512 3afab3ace2905a9c3506ac318d4c2f2f7e6677534a94f575eab3fbecff117eb5ba3c8121d2285c9c934e9adf0e1cee3792b8a89ef07f57628894f1744875156b
- SSDEEP 49152:VFHVYOAP0nr070gohzleCWbQX4FLicfUZXEtIY0foFBGuqFy07Huu1pfj8JcXXZK:nThr5k58ZXEHJEny0Zscm3d3H+G
- TLSH T1AB266C47F6B580ECC06AC079C71A6633FB72B84907217AEB56D086353F66ED06A3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
3717772
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
dissolute.pdb
bcryptprimitives
ProcessPrng
kernel32
WaitForMultipleObjects
GetSystemTimePreciseAsFileTime
GetCurrentProcessId
SwitchToThread
GetOverlappedResult
PostQueuedCompletionStatus
WriteFile
ReadFile
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetExitCodeProcess
SetLastError
AddVectoredExceptionHandler
HeapReAlloc
GetFinalPathNameByHandleW
CancelIoEx
CreateFileW
HeapFree
CreateThread
WaitForSingleObject
GetCurrentThreadId
GetModuleHandleW
GetCurrentProcess
WaitForSingleObjectEx
DuplicateHandle
CreateMutexA
ReleaseMutex
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
GetFileAttributesW
CreateProcessW
GetCommandLineW
IsDebuggerPresent
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
LoadLibraryA
GetProcAddress
lstrlenW
RtlVirtualUnwind
WideCharToMultiByte
MultiByteToWideChar
HeapAlloc
GetEnvironmentVariableW
CancelIo
FormatMessageW
QueryPerformanceCounter
GetProcessHeap
GetEnvironmentStringsW
GetTempPathW
CompareStringOrdinal
GetModuleFileNameW
SetEnvironmentVariableW
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
SystemTimeToFileTime
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
CreateEventW
WriteConsoleW
ExitProcess
GetStartupInfoW
ReadFileEx
SleepEx
WriteFileEx
SetHandleInformation
GetSystemInfo
GetFullPathNameW
FindNextFileW
DeviceIoControl
GetModuleHandleA
GetCurrentThread
SetThreadStackGuarantee
CreateDirectoryW
FindClose
LocalFree
CloseHandle
GetFileInformationByHandleEx
GetFileInformationByHandle
FindFirstFileExW
SetFileInformationByHandle
GetLastError
SetFilePointerEx
Sleep
SetWaitableTimer
CreateWaitableTimerExW
SetFileTime
CopyFileExW
FreeEnvironmentStringsW
DeleteFileW
QueryPerformanceFrequency
__C_specific_handler
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemDirectoryA
GetWindowsDirectoryA
ExpandEnvironmentStringsA
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
ws2_32
WSASocketW
WSACleanup
WSAStartup
closesocket
bind
connect
getpeername
getsockopt
WSASend
shutdown
send
recv
getsockname
WSAIoctl
WSAGetLastError
freeaddrinfo
getaddrinfo
setsockopt
ioctlsocket
ntdll
NtCreateFile
NtCancelIoFileEx
NtOpenFile
NtWriteFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtReadFile
NtCreateNamedPipeFile
_vsnprintf
log
memchr
memcmp
memcpy
memmove
memset
qsort
strchr
strcmp
strcspn
strlen
strncmp
strrchr
strspn
crypt32
CryptUnprotectData
uxtheme
IsThemeActive
comctl32
InitCommonControls
iphlpapi
GetAdaptersInfo
netapi32
NetGetJoinInformation
winmm
timeGetTime
winhttp
WinHttpOpen
WinHttpCloseHandle
msimg32
GradientFill
user32
GetWindowLongW
GetDC
GetClientRect
MapVirtualKeyW
CharUpperBuffW
ReleaseDC
MessageBeep
PeekMessageW
LoadStringW
GetSystemMetrics
RegisterClassExW
GetWindowRect
setupapi
SetupDiGetClassDevsW
dwmapi
DwmIsCompositionEnabled
shell32
SHGetSpecialFolderPathW
gdi32
DeleteDC
CreateCompatibleDC
GetDeviceCaps
ole32
CoUninitialize
CoInitializeEx
winspool.drv
GetDefaultPrinterW
comdlg32
CommDlgExtendedError
shlwapi
PathFileExistsW
powrprof
PowerGetActiveScheme
advapi32
RegOpenKeyExW
RegQueryValueExW
CryptReleaseContext
CryptAcquireContextW
SystemFunction036
RegCloseKey
bcrypt
BCryptGenRandom
vcruntime140
strstr
__CxxFrameHandler3
__current_exception
__current_exception_context
api-ms-win-crt-heap-l1-1-0
free
_msize
realloc
_set_new_mode
malloc
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
exit
_initterm
_exit
terminate
_crt_atexit
_endthreadex
_beginthreadex
_initterm_e
__p___argc
__p___argv
_cexit
_seh_filter_exe
_c_exit
_initialize_onexit_table
_register_onexit_function
_get_initial_narrow_environment
api-ms-win-crt-string-l1-1-0
strncpy
tolower
strcpy
isspace
toupper
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
psapi
GetProcessMemoryInfo
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
896KB
Virtual Size
896KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
23KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35403,
count=2, id=257, version=33145,
count=4, id=259, version=35403,
count=10, id=260, version=35403,
count=24, id=261, version=35403,
count=13, id=260, version=35730,
count=254, id=1, productName=Unmarked objects,
count=99, productName=Unmarked objects (old),
count=1, id=258, version=35730,