payload.zip
- SHA256 6e877755f7830bb075ac36089c4d01b73e0b8efe6845b5e0fdf14e21b90670f6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
payload.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
payload.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target payload.zip
- Size 326KB
- Sample260827-pwpdnavdkg
- SHA256 6e877755f7830bb075ac36089c4d01b73e0b8efe6845b5e0fdf14e21b90670f6
- MD5 49a566577da135afc134a3ce0df5c5b8
- SHA1 91e138ce44dd3a03b700389520bf1bb78e81de71
- SHA512 6c7a115e0cb3b2494453bf494f484b2aa04f73cd90af73ea3aeedbd936e85a01b322bc88491a404639c3791358a3c2e71343c1bfeeda7438cfe712e681bee263
- SSDEEP 6144:Uvoji4END6dCG4a5dBiSYt+uPLN+o4JFBsW6zxInLRf2uNUQWHBCuuT5P8tdPhC1:U0rCGHWLYo0FB96zynLEuAHtk85CSR0T
- TLSH T1D664231BB3AC9957005AC17C913A725F22CEC92ADD87F1AD35507AEE902C1AF4DDC263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loader.exe unpack001/payload.dll
File Explorer
-
payload.zip.zip 326KB
-
Loader.exe.exe 61KB
-
payload.dll.dll 580KB
Loader.exe
- IMPHASH 4be2cb40793241bb96b83713df420ddc
- SHA256 252a2cd116f0b4088e69dc7c9f7fab16e13b054dd42228ebeb0b8e17ba83d713
- MD5 2c6913dbbd92afa764a9c5a46fe04dae
- SHA1 0fdec08e96ee1d926f3f71dfb57578cf76516d02
- SHA512 59b38a908fdc9da2a259f2645f6c984ba0bfecbe87bd5ba9896a766618baebea260c78a9e2d4c517ab5d4367010e2157159c6608bbdf51c5655fcc7bc3f4d9e7
- SSDEEP 1536:L4k2c12fRm8QNRuJEaTAuU3d3S1UHZB9oCeHXBW4Y:L4k2fyNRuJ+53FSQgHf
- TLSH T16A533C9375058036E85012B128296BBE42FFAF30479557D3BFC09EBBC9211F66CF1A56
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
39922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathRemoveFileSpecW
PathAddBackslashW
PathCombineW
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleFileNameW
GetLastError
WriteProcessMemory
SetLastError
TerminateProcess
GetEnvironmentVariableW
WaitForSingleObject
ResumeThread
CloseHandle
VirtualProtectEx
VirtualAllocEx
ReadProcessMemory
CreateProcessW
IsWow64Process
VirtualQueryEx
GetExitCodeProcess
GetCurrentProcess
GetCurrentThreadId
GetModuleHandleW
GetCurrentProcessId
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
msvcp140
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Xlength_error@std@@YAXPBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
??0_Lockit@std@@QAE@H@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
vcruntime140
memcpy
memchr
memset
__current_exception_context
__current_exception
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__std_terminate
_except_handler4_common
_CxxThrowException
memmove
api-ms-win-crt-runtime-l1-1-0
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_exit
exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_initterm
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_initterm_e
_controlfp_s
api-ms-win-crt-stdio-l1-1-0
ungetc
setvbuf
__stdio_common_vswprintf
fputc
_get_stream_buffer_pointers
_fseeki64
fgetpos
fwrite
fread
fsetpos
fgetc
fclose
fflush
__p__commode
_set_fmode
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=260, version=31328,
count=1, id=259, version=31328,
count=27, id=261, version=31328,
count=4, id=257, version=31328,
count=7, id=257, version=27412,
count=178, id=1, productName=Unmarked objects,
count=5, id=265, version=31332,
count=1, id=255, version=31332,
count=1, id=258, version=31332,
payload.dll
- IMPHASH bb59bbe48496ba5222ba6bcd777e6397
- SHA256 b0b787a8bed3be6ade3c33f192533e52091a72706f7a9ee85483ef8a4608e6e7
- MD5 21f2cc65b73f6f2959cc7ee278cee8dd
- SHA1 4716f1af86041bf3838a33a0922fe001a8e99909
- SHA512 9cff5345bcebd15244642ee09a8ca0876578e93228961b92427806495a6a0caf698567a0716270001f019b241b2249646e94f0d8a242e2cc5c425ec156e66c2f
- SSDEEP 12288:TJeiw3ozbOYidMMG5O7JyRKIOP7ZNcgnGdl8zMpcQzTAbUbfm2f1MaO7LpRfz3TI:TJeiw3MbOYiqKIOP7ZKgnGdl8zMZTAbW
- TLSH T1B3C4BF227582C072E8BE01715969BFB956BDB5310B7249DFA7C02E3D5F305C2AB32A47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
295330
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\GalGames_Work\OnWork\个人研究向\HxEncryption_TestBase\publish_src\Build\Release_x86_payload\payload.pdb
kernel32
InitializeCriticalSectionEx
HeapSize
Sleep
GetLastError
GetCurrentThread
LockResource
HeapReAlloc
RaiseException
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
HeapFree
WideCharToMultiByte
SetConsoleCtrlHandler
VirtualProtect
WriteFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
CloseHandle
ExitProcess
AllocConsole
SetConsoleTitleW
VirtualQuery
GetModuleHandleW
SetEndOfFile
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
VirtualProtectEx
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQueryEx
SetLastError
FreeLibrary
LoadLibraryExW
GetFileAttributesW
SetFileAttributesW
GetFileAttributesExW
DeleteFileW
MoveFileExW
LocalFree
GetFileType
GetTickCount
ReadFile
GetFileSizeEx
SetFilePointerEx
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
WaitForSingleObjectEx
EncodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetLocaleInfoEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetDateFormatW
SizeofResource
user32
GetActiveWindow
MessageBoxA
shlwapi
SHCreateStreamOnFileEx
bcrypt
BCryptGenRandom
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDeriveKeyPBKDF2
BCryptHashData
BCryptSetProperty
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptDestroyKey
BCryptDestroyHash
BCryptGetProperty
BCryptGenerateSymmetricKey
advapi32
GetSecurityInfo
CreateObject
Name
.text
Size
450KB
Virtual Size
449KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=259, version=27412,
count=189, id=261, version=27412,
count=22, id=260, version=27412,
count=15, id=260, version=31328,
count=24, id=259, version=31328,
count=81, id=261, version=31328,
count=2, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=13, id=257, version=27412,
count=192, id=1, productName=Unmarked objects,
count=100, id=265, version=31332,
count=1, id=256, version=31332,
count=1, id=255, version=31332,
count=1, id=258, version=31332,