download.zip
- SHA256 938136eca9dea56a49a8ef70710e8922cbb31687de628baf5ca374c7350eece3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target download.zip
- Size 84KB
- Sample260905-amdhgaba87
- SHA256 938136eca9dea56a49a8ef70710e8922cbb31687de628baf5ca374c7350eece3
- MD5 feb36e29ac649a1adec4fbcd1662bb42
- SHA1 47636b0a9a5991ee2d0222acd1069236c63e4e16
- SHA512 d50118cf2249a895c77f4e19538ace9eb05ddf821b26d38ed4546ef8a0519cbd7d9d63d3c808847a9878ec6c7711bcedb9bc837e634836e1cf4fc7a0d0023896
- SSDEEP 1536:9AKhVWLli+28JA2rJZxEPeZp533K/FZWlIRLcAdz+z07:fMJ/9H2eH5YWlaowzG07
- TLSH T1EB831224D67444B889366C56E0DB69CC8BC04D39CFFDB0301AB5D8780AB664FEB6B197
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/.exe
File Explorer
-
download.zip.zip 84KB
-
.exe.exe 97KB
.exe
- IMPHASH 1211e578b49291efa65261752c9df91a
- SHA256 0a62fb7131a1fa89f0c1966eddd1c893d6e7d8c53c104238facc8d14b0139765
- MD5 cccce0de22fc209e6a3f0be27b86a8b1
- SHA1 6a29d689438234a09d67cd71407db76b5e760c79
- SHA512 bb6c20941e91d18d47997cdda2f01835eb1ad327ac3fc0845a47c7c1dc23cac6456b918aeefc1c9e1781e247d64eb110dbb1d917538cc2ca36456a7630a98d63
- SSDEEP 1536:k2QVxKF0TpdOTPk2W6hPAchbavEEPeZp533K/FZWlIRLcAdzUPVz4twMG7:3YjtEg2TucsDeH5YWlaowzU9ctwMA
- TLSH T150A3F1BB9D240CA2C2C3827560A1280ADFDFAFB57E644827D6956CD139F4DD7D63A203
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
6670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\new2DNet\Rocket\Product\Rocket.pdb
kernel32
lstrcatA
MultiByteToWideChar
lstrcmpiA
GetProcAddress
CopyFileA
LoadLibraryA
SetNamedPipeHandleState
GetModuleFileNameA
lstrcmpiW
GetModuleHandleA
VirtualProtect
GetVersionExA
GetTempPathA
lstrcpyW
DeleteFileA
lstrcpyA
GetFileSize
FindResourceA
FreeResource
SetEndOfFile
GetSystemDirectoryA
LoadResource
GetCurrentProcess
Process32First
GetSystemTimeAsFileTime
SizeofResource
CreateProcessA
Process32Next
LockResource
CreateToolhelp32Snapshot
LocalFree
SetEvent
ExitThread
lstrlenW
OpenEventA
OutputDebugStringA
DuplicateHandle
GetCurrentProcessId
GetSystemTime
CreateThread
CreateEventA
Sleep
OpenProcess
GetCommandLineA
WaitForSingleObject
VirtualQuery
lstrlenA
ExitProcess
CloseHandle
DeviceIoControl
VirtualAlloc
GetLastError
ReadFile
WriteFile
VirtualFree
SetFilePointer
FreeLibrary
CreateFileA
user32
FindWindowA
PostMessageA
SendMessageA
wsprintfW
wsprintfA
advapi32
SetEntriesInAclA
RegCloseKey
RegOpenKeyA
ControlService
OpenSCManagerA
QueryServiceStatus
StartServiceA
CreateServiceA
RegQueryValueExA
CloseServiceHandle
OpenServiceA
SetNamedSecurityInfoA
LookupPrivilegeValueA
BuildExplicitAccessWithNameA
AdjustTokenPrivileges
GetNamedSecurityInfoA
OpenProcessToken
shell32
ShellExecuteA
shlwapi
SHDeleteKeyA
SHSetValueA
SHGetValueA
PathFileExistsA
SHDeleteValueA
psapi
GetModuleFileNameExA
msvcrt
_except_handler3
??2@YAPAXI@Z
??3@YAXPAX@Z
srand
rand
strtoul
strrchr
_access
strstr
memset
memcpy
CoCreateInstance
CoGetMalloc
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
GradientFill
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=4, version=8047,
count=2, id=14, version=7299,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=98, id=1, productName=Unmarked objects,
count=4, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,