6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.zip
- SHA256 2139d39bbe012e20981b5ee700ef7b316f6862d8fceea77e89e7d7c7501b86be
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.zip
- Size 1.8MB
- Sample260831-npbcsa1bkf
- SHA256 2139d39bbe012e20981b5ee700ef7b316f6862d8fceea77e89e7d7c7501b86be
- MD5 240cf1f70822ed3a4b1eb00dc5469363
- SHA1 2f8400a77dbebfa55ddd6e787670aed80ff33618
- SHA512 b59aae522f9bf03acad4b9d60969583b969618d68368fcaccb18575feb110432f6621be5468e924e2d8cd5e527a9a5dd6561f2b0777be40a372743e9038af51e
- SSDEEP 49152:NspgcgXoQmwUCq9/v73LrsObf19aAxaoDkVSvkcF61:NsxFPlvn11MMDySlo
- TLSH T1719533ABF7AFA36723815C5953213A0065141BCAFADB85389E1C3C1E78E116ED3D3E46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.exe
File Explorer
-
6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.zip.zip 1.8MB
-
6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.exe.dll 1.9MB
6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28.exe
- IMPHASH 0cdadfa1098d845dd3b4cf92625b5f04
- SHA256 6ff223a7988f69d4c854105d0f5d7539c5b50e10afd47c35db2e26d3111b5a28
- MD5 996e9a0273c2c8150eb32d94523a203b
- SHA1 f2a9bebdf7158ebf9cfca599c541a89977c2b6b8
- SHA512 ee99103bb906a4304cc0ad4cdb4d6e4526771daf0f45d3221e266e4bbf6dfe03c74b38172d06783f09c21a9c808025936eb4af395907841aa8f9911c38cf975d
- SSDEEP 49152:jnYnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SA6:DI8qPoBhz1aRxcSUDk36SA6
- TLSH T13F95235A72BC91BCD006267444F78E23E7B37C9A13F96A0F8B8049AA1E13755BF64742
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
5612
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
WriteFile
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
CreateProcessA
GetCurrentThreadId
FlsSetValue
GetCommandLineA
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
TerminateProcess
GetCurrentProcess
RtlUnwindEx
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapFree
Sleep
GetProcAddress
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
LoadLibraryW
GetModuleFileNameW
SetStdHandle
WriteConsoleW
MultiByteToWideChar
LCMapStringW
GetStringTypeW
HeapSize
CreateFileW
FlushFileBuffers
PlayGame
Name
.text
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=83, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=80, id=1, productName=Unmarked objects,
count=23, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,