main.zip
- SHA256 4fee323ca72ff9c390e7e25d9132e0fd89a625501c0b6708fe9101e064589576
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
main/universal+spoofer+cleaner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
600 seconds
Behavioral task
behavioral2
Sample
main/universal+spoofer+cleaner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
600 seconds
General
- Target main.zip
- Size 28KB
- Sample260905-zcbcsshq7w
- SHA256 4fee323ca72ff9c390e7e25d9132e0fd89a625501c0b6708fe9101e064589576
- MD5 fddad3f7bb2633efaefcd8cd7ad86bfe
- SHA1 f1afdb20685efa15006b39846ff17e2bddf34fb1
- SHA512 58901f94ac8d2ab8978b6ef6d24d60074787001f30bb1d2a58b26c73cf7d372da1848959760fac07fcfd3c4b8d28edcb488db7eba1546bca6ae434f6ba73e866
- SSDEEP 768:EhDKf8zr7I7GV458sx8QAbzdSfsDoMc6DZww3:kDK2XI7GVp1QAXdqsDzoM
- TLSH T1B2D2F2C1E14CD7F1D3689A39240BE4FE4594936E2E1E260F1F910AB1729D8AE6660FD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/main/universal+spoofer+cleaner.exe
File Explorer
-
main.zip.zip 28KB
-
main/universal+spoofer+cleaner.exe.exe 68KB
main/universal+spoofer+cleaner.exe
- IMPHASH 8a6297ae5410c1a808d7ce5bb994ebe1
- SHA256 3ab8045442218bd36585017deff206d8501c0d3ba7b781a9d79dae06ffc79d17
- MD5 e0248647e9980cadb54103bf6761ceac
- SHA1 1055e678195109e0afcee1e3aa7df35eef0f4b76
- SHA512 3473e4a5ddfa90b0130f9f6e2834915775bcd876383ded5acf1af0e2060da49e5cbf5ff6395cc9c6e6e67ddd3662fcbaf515a4b4d57bd3b7478a020eb6952dc6
- SSDEEP 1536:45qdohCcbQ16WpY6Dk8ne8ovTeqmCT6eH58gqWBO6V5VSizyOnXvc1Pk:45VfbQkkYv8neXCqmCTb5kSSi7XvePk
- TLSH T1AC63096667D400ACE2B7D3B89EF39512F736BC0417319BDF0340415A0F26AD4AE7AA67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
37056
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\alket\source\repos\ConsoleApplication4\x64\Release\ConsoleApplication4.pdb
kernel32
Process32FirstW
CloseHandle
GetSystemTimeAsFileTime
DeleteFileW
SetConsoleTitleW
AcquireSRWLockExclusive
InitializeSListHead
GetCurrentThreadId
Process32NextW
GetLastError
Sleep
CreateToolhelp32Snapshot
SetFileAttributesW
OpenProcess
FindClose
GetModuleFileNameW
RemoveDirectoryW
TerminateProcess
GetCurrentProcess
FindNextFileW
GetSystemTime
FindFirstFileW
GetCurrentProcessId
QueryPerformanceCounter
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetModuleHandleW
ReleaseSRWLockExclusive
user32
MessageBoxW
advapi32
RegCloseKey
CryptAcquireContextW
CryptGenRandom
RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
RegDeleteValueW
GetUserNameW
RegQueryValueExW
CryptReleaseContext
GetTokenInformation
shell32
ShellExecuteExW
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Id_cnt@id@locale@std@@0HA
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__std_exception_copy
memcpy
__std_terminate
__current_exception
__current_exception_context
_CxxThrowException
__C_specific_handler
__std_exception_destroy
memmove
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
system
_crt_atexit
_cexit
terminate
_set_app_type
_register_onexit_function
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
_exit
exit
__p___argc
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
fputc
_get_stream_buffer_pointers
__acrt_iob_func
_fseeki64
fread
fsetpos
getchar
ungetc
setvbuf
fgetpos
__stdio_common_vsprintf
__stdio_common_vswprintf
fwrite
__stdio_common_vfprintf
fgetc
fclose
fflush
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
_set_new_mode
api-ms-win-crt-string-l1-1-0
wcslen
strlen
_wcsicmp
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35721,
count=10, id=260, version=35721,
count=29, id=261, version=35721,
count=6, id=257, version=35721,
count=9, id=257, version=33145,
count=175, id=1, productName=Unmarked objects,
count=1, id=265, version=36256,
count=1, id=255, version=36256,
count=1, id=258, version=36256,