Новая сжатая ZIP-папка.zip
- SHA256 4f3fb730f5839b2587bbd6681acfbe2429caa598454137f5fa403e64882d7566
Overview
overview
10Static
static
3Новая...а.zip
windows10-2004-x64
1Новая...а.zip
windows11-ltsc_2024-x64
1Installer-...1).exe
windows10-2004-x64
7Installer-...1).exe
windows11-ltsc_2024-x64
10[paste-co....her.py
ubuntu-18.04-amd64
1[paste-co....her.py
debian-9-armhf
1[paste-co....her.py
debian-9-mips
1[paste-co....her.py
debian-9-mipsel
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Новая сжатая ZIP-папка.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Новая сжатая ZIP-папка.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Installer-1.0.9 (1).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Installer-1.0.9 (1).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
[paste-co.de] madium patcher.py
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
[paste-co.de] madium patcher.py
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
[paste-co.de] madium patcher.py
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
[paste-co.de] madium patcher.py
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target Новая сжатая ZIP-папка.zip
- Size 9.7MB
- Sample260831-sg4rkshb49
- SHA256 4f3fb730f5839b2587bbd6681acfbe2429caa598454137f5fa403e64882d7566
- MD5 ed14ccd9d247f015fd13aaa0f9cef91b
- SHA1 9cd65aba10953f5d0502ee147b1e8717116cadb8
- SHA512 dd2cd1dd7591a6f8a2c14fd71c1102d3b7c263fd11742b68a8dc0cacaf457b28d127b51efea7b6526034a0902418937e82c36eee7850e27775c4c2e7663cadcb
- SSDEEP 196608:9/9yNfDB5U7rmx3XfusmbWoJA+izVF77hrPeb8nH5DtOlKhGS/gh4Cu:91GDEXmx3XtmaiA+kV5R2b8nJ0lKZ+u
- TLSH T1E9A6338209EA0BA2784CC73E5AFEA1D6261869F55D1DD4D1F5A03C139B501BA2FCB0DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Installer-1.0.9 (1).exe
File Explorer
-
Новая сжатая ZIP-папка.zip.zip 9.7MB
-
Installer-1.0.9 (1).exe.exe 9.8MB
-
[paste-co.de] madium patcher.py.py .sh 5KB
Installer-1.0.9 (1).exe
- IMPHASH 99186799183134845e3e1dd8f17e7a37
- SHA256 6c1bfdb571e85b8a1e0566f008f9eef8dab6baa4088a48d3b9c7ea9c7e9bfd9a
- MD5 f3c25a3f9f0298df7f616425569f29eb
- SHA1 3b104a986f9b54b5afad33a1e2dd6e11126cdcfa
- SHA512 467cd145d72728f79c130a337562b9d6a8f426a3b631a19a773071309783b560db7226bcf519cdfda1a84598ca21e52f4769f05c0e6ec254ab691bb35109e807
- SSDEEP 196608:okEbIPQNfiDq3tdrsGj4CH4k4TL1JNRX/XURvSyGZ1GihcwFNdjO6:tY1wW3tOGcm4kGLDNtkRvAEip/
- TLSH T187A633C355F90AF2F06EC23D4EEA5181D736B8B62715C6C3A2A018335F226F45E6B197
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
34420
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ole32
CoTaskMemFree
CoCreateGuid
StringFromGUID2
setupapi
SetupIterateCabinetW
shell32
SHGetKnownFolderPath
kernel32
GetSystemTimeAsFileTime
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
CreateFileW
WriteFile
GetTempPathW
CloseHandle
GetLastError
SetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
FormatMessageW
FlushFileBuffers
HeapReAlloc
HeapSize
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCPInfo
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
user32
MessageBoxW
Name
.text
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9.6MB
Virtual Size
9.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=47, id=261, version=35207,
count=1, id=262, version=33145,
count=11, id=257, version=33145,
count=130, id=1, productName=Unmarked objects,
count=1, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,
[paste-co.de] madium patcher.py
- SHA256 8d98befb355d7cdceeac0375d4a1d294db3c4d7565ef4162b9d31ed79b6a8e2c
- MD5 2352d068a3c2565420b821ae74f49a97
- SHA1 006c33aee743e9b90f96e1525c87e016fa1d52a5
- SHA512 755d61a55a63cee5b7b7f7cf54d24f08634153cc1467b165aac5b48958a49d787fc24a0a98bdebacf1bf2188cc7475a2d3469abaefecee739828d8a01359818e
- SSDEEP 96:QsHaoARgFhpn65d6PvjVB/fMqpDUrUpqanRElnoU0VDL6EBpH2pfIqwBrQzfckml:Q5XQPMGv5dUqdoUpqaRKnB0VDL6EXRqk
- TLSH T1C8B1851699B154E0E7C3A1EA495944197AABF91B7310D271B8EC8FAC2F9C438D2709F8
- MD5 SHA1 SHA512 SSDEEP TLSH