Shadow.zip
- SHA256 56d71c0b15eea4535f6fc5392d7df109c14f33e1c01813489a0feb464bd7e172
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Shadow.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Shadow.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Shadow/Shadow.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Shadow/Shadow.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Shadow.zip
- Size 644KB
- Sample260906-3af22shr2x
- SHA256 56d71c0b15eea4535f6fc5392d7df109c14f33e1c01813489a0feb464bd7e172
- MD5 cd809f6674e654bf68479c7451af232a
- SHA1 66d77d0d59502501cf3debe134eae2977cf7d277
- SHA512 baf7db9487d7e8b2207a153b1fbd3fb12e8d5156f539908d2cd1ed0816341de30040b701c6292a4959f6edd7889f1e44fd852dec96ad44ecfcf1f612fc38a7de
- SSDEEP 12288:R7O3dnDGnQI7xT6HfZtB/p42kCAeBT9hkmxf0TcB5DcN3bR9wy2OqMR38KD5jx:R7ON257xUxhJf0g5DI3bR9wOr5nNjx
- TLSH T169E433C883CC95C83D95DDBB9A183F3E4E9194E119637C2CFE4EA916ACCC359D8099B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Shadow/Shadow.exe
File Explorer
-
Shadow.zip.zip 644KB
-
Shadow/Shadow.exe.exe 722KB
Shadow/Shadow.exe
- IMPHASH d58f90ab09136b6c24cc6ed4f9947cfb
- SHA256 3cd64f4d6f2e5d0b45f06477e4a010cef164e45f6e0952aec8c1e0338874107f
- MD5 1964102f0033578367168655d69d97f4
- SHA1 31757cb81382291687519b897dd340ff2af319f2
- SHA512 989d9b0b11a65493b5f0d4965067c85d2cfddf7ee6a7a702ffee0dcf66f002c4533f9bc776aa76b3b969de623574fbb2ef3a7c042547ea06395afdccb709862e
- SSDEEP 12288:UekWRx1GJsCWazbRo5z5qs73TCHJZRl/pu2aCAeHTnhkIDfeDWB5MQ3isw/bD9wa:vz5qs732Bhnfei5MQSzbD9MOOrrjwf
- TLSH T1AFF41280F3C1D0B2D4F7043A05F8ABB68D2DA47517316CEB634857A9DA743C1AA3AB57
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
47616
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
LCMapStringW
LoadLibraryExW
VirtualProtect
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
DecodePointer
HeapAlloc
GetModuleFileNameW
GetTickCount
GetProcessHeap
HeapFree
GetLastError
CloseHandle
WriteFile
GetFileAttributesW
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
IsProcessorFeaturePresent
RtlUnwind
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
RaiseException
GetStdHandle
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
WriteConsoleW
user32
wsprintfW
LoadIconW
LoadCursorW
PtInRect
FillRect
ScreenToClient
GetCursorPos
SetCursor
AdjustWindowRect
GetClientRect
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
DrawTextW
KillTimer
SetTimer
ReleaseCapture
SetCapture
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
TrackMouseEvent
dwmapi
DwmSetWindowAttribute
gdi32
MoveToEx
SetTextColor
SetBkMode
SelectObject
RoundRect
LineTo
Ellipse
DeleteObject
CreateSolidBrush
CreatePen
CreateFontW
Name
.text
Size
114KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
567KB
Virtual Size
566KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=33145,
count=142, id=261, version=33145,
count=19, id=260, version=33145,
count=20, id=259, version=35721,
count=17, id=260, version=35721,
count=37, id=261, version=35721,
count=9, id=257, version=33145,
count=127, id=1, productName=Unmarked objects,
count=7, id=261, version=36256,
count=1, id=255, version=36256,
count=1, id=151,
count=1, id=258, version=36256,