PayloadFile2.zip
- SHA256 bfd1dbf4e53ad0e9d6aaf95d2cf716b9462125a0205809be54bae92d03bb2788
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PayloadFile2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
PayloadFile2.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target PayloadFile2.zip
- Size 2.1MB
- Sample260905-znk2daseng
- SHA256 bfd1dbf4e53ad0e9d6aaf95d2cf716b9462125a0205809be54bae92d03bb2788
- MD5 908d9998cc73d464212ee903dc54d092
- SHA1 248a683b17dd76c5bd9cb17dde9f41a43cd413ec
- SHA512 4678c415d5f7deab39ebeaba9c27b3bbb6788d03c9d42fbe1b42f015e723feac50dbceb73a33f7e659ab8699b0e21181ca2118784646e1ff19e4d75b6059ce97
- SSDEEP 49152:2WNGtbij4NQMv+BM29PywVJZnYzlScVwh6bcyz7/rv6dq/:2WgbRNQMv+6/wKzlScugcyz7L6d6
- TLSH T17AA53304A543935C684864C589F2A6520575F26E6DB3C020EBDC8FA315FEF3FBDA6AC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PayloadFile2
File Explorer
-
PayloadFile2.zip.zip 2.1MB
-
PayloadFile2.exe 5.0MB
PayloadFile2
- IMPHASH 4d2b0b9dc0b266c68eb162e9fbbe2a6f
- SHA256 dd17fd5082dbda37daab52dc1f09879c54f5402d94dbb1b58d98c8a6057fc642
- MD5 b27f46ffad16ad28cfbccb68eb65788a
- SHA1 3e9f8d6ce0a624b1101be3d524904bb74b80090f
- SHA512 bc581ae43299bcb8c772397d3a078d5feff782727b9b1e1b85c096403c4a1f842254cfd3c0bb68a2cf07605358223418e7af3c3e7fbfef907a4372c3704d520d
- SSDEEP 49152:dJcSo8Mcvs8lh/jVSp0oBIHd6MdDAxUJ5dryveMmQLGrUZGVXIU6ircSo51DJ:h0hO/GARvyvhyY+rcSo51
- TLSH T131363912BB5699EDC1AAC474834646721A7274CB0F35AAFF44C492393E79AF41F3C368
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
5251724
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
FlsGetValue
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
CreateDirectoryA
GetCommandLineA
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
HeapSize
GetModuleFileNameA
LocalFree
GetComputerNameW
GlobalAlloc
SetLastError
GetFinalPathNameByHandleW
GlobalLock
GetLastError
GlobalUnlock
GlobalSize
WideCharToMultiByte
GlobalFree
MultiByteToWideChar
GetCurrentThread
RtlVirtualUnwind
GetQueuedCompletionStatusEx
FormatMessageW
FreeEnvironmentStringsW
CreateFileW
CloseHandle
GetFullPathNameW
SetNamedPipeHandleState
GetCurrentThreadId
GetStdHandle
GetCurrentProcess
CopyFileExW
GetProcessHeap
HeapFree
HeapReAlloc
QueryPerformanceCounter
CreateThread
GetCurrentProcessId
SetHandleInformation
FlushFileBuffers
WaitForSingleObject
RtlLookupFunctionEntry
GetSystemTimePreciseAsFileTime
CreateIoCompletionPort
TerminateProcess
GetEnvironmentStringsW
SetFilePointerEx
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentDirectoryW
GetCommandLineW
SetFileCompletionNotificationModes
FindFirstFileExW
FindClose
ExitProcess
SwitchToThread
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
SetEnvironmentVariableW
HeapAlloc
GetModuleFileNameW
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
CreateWaitableTimerExW
SetWaitableTimer
Sleep
FlsFree
FlsAlloc
GetModuleHandleExW
GetModuleHandleW
FlsSetValue
IsThreadAFiber
GetFileType
ReadFile
GetOverlappedResult
GetModuleHandleA
QueryPerformanceFrequency
WriteFile
FindNextFileW
RtlCaptureContext
lstrlenW
PostQueuedCompletionStatus
CancelIoEx
advapi32
GetUserNameW
RegSetValueExA
RegOpenKeyExA
ConvertSidToStringSidW
LookupAccountNameW
RegCloseKey
ImpersonateAnonymousToken
RevertToSelf
SystemFunction036
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
WakeByAddressAll
ws2_32
WSAStartup
WSAIoctl
setsockopt
shutdown
WSASocketW
bind
WSACleanup
send
recv
connect
ioctlsocket
WSASend
getsockopt
getsockname
getpeername
getaddrinfo
freeaddrinfo
closesocket
WSAGetLastError
ntdll
NtWriteFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
NtCreateFile
bcryptprimitives
ProcessPrng
bcrypt
BCryptGenRandom
user32
CloseClipboard
OpenClipboard
IsClipboardFormatAvailable
EmptyClipboard
SetClipboardData
GetClipboardData
RegisterClipboardFormatW
shell32
SHGetFolderPathA
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.cfg
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/21
Size
5KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=144, id=261, version=33145,
count=27, id=260, version=33145,
count=20, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=41, id=261, version=35207,
count=12, id=260, version=35228,
count=13, id=257, version=33145,
count=242, id=1, productName=Unmarked objects,
count=357, productName=Unmarked objects (old),
count=1, id=258, version=35228,