virud.tar
- SHA256 33256269f89069122c73e6e4bb0e2af65428cc80bfe19282637c4e6765602629
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
pago -898923-887340450909437-93434.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
pago -898923-887340450909437-93434.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target virud.tar
- Size 249KB
- Sample260908-flvcgsda85
- SHA256 33256269f89069122c73e6e4bb0e2af65428cc80bfe19282637c4e6765602629
- MD5 0e8e6035525273fdbe044a337aeff61d
- SHA1 4c8916f50ee372ba1d46ec5e8d4fbfa41a3711a3
- SHA512 95f62559275bb891463ab8b456498aa4c321066047190994001380d2d27f1be7d0b00d9640bd2617a94dcf0c2672956affb26d2898f8c4590732cbc6cbbf5753
- SSDEEP 6144:OWWWhZEC8T7VwMa99/qgj+Njv11OOMjjBzefgQp:l9YhU/tydbwsg+
- TLSH T1DB4423E72408C5C2648FE9C1D370E0F7AB5C3D758EE1653AF68B8D557B28AA9CD3A400
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/System.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/pago -898923-887340450909437-93434.exe
File Explorer
-
virud.tar.rar 249KB
-
pago -898923-887340450909437-93434.exe.exe 283KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Bidragsvilkaarene19KB
-
Nomap177KB
-
nagualist.pyx63KB
-
tautens.ond58KB
pago -898923-887340450909437-93434.exe
- IMPHASH 46ce5c12b293febbeb513b196aa7f843
- SHA256 939cfd0ed568db0f2e856a4febb9f8fd96aa031086cfc0e8c99a1cbaaa86796d
- MD5 5242343341f0cef4bb76c23e011dd78a
- SHA1 bdc84402f753c6f8d20017d6ee12c771929ba274
- SHA512 70be956cf7eca891e4d6e6783ac5fd6a805ee26cff669e9a12b5db79aeab71452a90e0afcb716fd907830e0ef412144d3f168609bf928e730237f16cb87243b7
- SSDEEP 6144:cX45rw6BsvoivXiIExdWlCLZEkL/M5hlPDr6QJ6:cX4pgvXiVdWlyZtTcDrXI
- TLSH T1875412459654C0A2E5B30B70AD7487B56FDCBE2A2995034B2701BF8FFC336A50D0E29D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
10:e6:35:19:ec:29:77:c9:d9:20:2e:b8:30:3a:15:e8:4b:cd:4a:52:0a:1d:78:77:f6:b0:06:40:6a:3b:e0:4a:9a:99:c8:f8:60:2e:d4:71:eb:6b:3c:06:ed:09:71:50
Digest Algorithm
sha384
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Glyoxilin,OU=Hyperdeterminant Snydefuld\ ,O=Glyoxilin,C=GB
Chains
Aug 10, 2026
CN=Glyoxilin,OU=Hyperdeterminant Snydefuld\ ,O=Glyoxilin,C=GB
Subject
CN=Glyoxilin,OU=Hyperdeterminant Snydefuld\ ,O=Glyoxilin,C=GB
Serial Number
10:6e:94:e3:eb:37:7a:ff:e7:eb:49:88:18:19:cc:22:3c:24:cd:bd
Issuer
CN=Glyoxilin,OU=Hyperdeterminant Snydefuld\ ,O=Glyoxilin,C=GB
Revocation Status
Not revoked
Timespan
Jul 12, 2026 - Jul 12, 2027
Subject
CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
13983
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegEnumValueW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
IIDFromString
CoTaskMemFree
comctl32
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_Create
user32
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
IsWindowEnabled
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CharPrevW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
CharNextA
wsprintfA
DispatchMessageW
CreateWindowExW
PeekMessageW
GetSystemMetrics
gdi32
GetDeviceCaps
SetBkColor
SelectObject
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
kernel32
RemoveDirectoryW
lstrcmpiA
GetTempFileNameW
CreateProcessW
CreateDirectoryW
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
WriteFile
GetCurrentProcess
GetModuleFileNameW
GetLastError
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
MulDiv
lstrcpyA
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 509a34b3a68a773e0afb4259e68f9f82
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Bidragsvilkaarene
- SHA256 c6e08b56da77ce9bb2816698897b4a35a7fe33ff2c6e0beda4d0259e78588776
- MD5 f414987660e185b91f0934b330ffa961
- SHA1 86d7f0da18e37a2d0542163395fa0583e26788eb
- SHA512 860a321409e3b34c91e7bdbbc223e7ac45cab39383bbfa9e95b771ab03139c4910e495aaf6c485c32b68dd56b9bfe856e071ac8f6883b45a6ca2b217956c7a80
- SSDEEP 384:6pnJzupHT1NoGwyYflXa0LqtHz/JgstK4:65Nu5g/f5a6qRJR
- TLSH T139928E025637CC77DC07A53C81BC50EA5C6DB46A7B4FB0F6227B6D5042931E29B348AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Nomap
- SHA256 914e657a8299c53a5f81c6ea2885c76a74880358c137e7c132566f260a2ee9b6
- MD5 23db9a4177e78d115f640ed51a24b7aa
- SHA1 de844074447fc3169b4a1164b5928580277574cc
- SHA512 bc660444ab8c33a5f3f1b2f8a329c8cc4e7b8b18b702b58082af80c12738e255cb8a79de0f4cabee1ef1ad8a79dcbf8a950780adfe015f6f759c14b345c138f8
- SSDEEP 3072:HvWijXiCOMCwkgG1oh4olW1wRo5ZguDTO8WrkrEUqKQHFGwH4OY5qW9b:Hv3Di9wkx1onc8o5OuDlWl5KQlZHK5qy
- TLSH T17704E1A5E2DF740CDD68832D2233814101CE148727AA0DBE9D79A5F5DD28E6F2D5B8CE
- MD5 SHA1 SHA512 SSDEEP TLSH
nagualist.pyx
- SHA256 06c342bd260b37fa20387847f4f8b34f83d9171870ddd801552203d4fa2048d3
- MD5 47dd8830499ec4b4a352a00b505bf0a4
- SHA1 e0f5656f8162f276e87084ed34897c30a4d5264e
- SHA512 c35b2ba59988850ae4e5b7162fe28f7b36739caa0902593287dd6c3be60bc5ff99d4d9e483f8704d3383749ab18754c4d98f096ff7144e678549f5a2aaed1353
- SSDEEP 96:hTXGyoFWy+7ALuaQTDsSWPL+tPAd3TE1imt:dXG/FWsu6SWPitPAd3TE1T
- TLSH T16353F890CA914080E7D67D5D8C464E8897F68DD3B329A586291CF1D3998327C213815D
- MD5 SHA1 SHA512 SSDEEP TLSH
tautens.ond
- SHA256 fadeb760a63b625bb15942120aacecb49cde61492eabd3e5f1f116efe84019f7
- MD5 84b12958a0d74d3ece71d1bebbdc7126
- SHA1 c61f3d502df1d0d804d71015e2db4bac76c18eb0
- SHA512 e2dafe49024915a25722f2ded8918a2d3b4fb39a20f04f21fd6c578a4f7e0b39c19a554cde348f6419ec7756e53234fedb216b41eac9ac382cbffad8f834ca2f
- SSDEEP 48:QDUzmrllEA+NdMnYrzizFDh7uaeueYvdmzXZ/43Xb1Mu4l:oUFFaYr+zFDh71YSdIXAXW
- TLSH T12C430B28E53D584EBEC22677945C689115922025A6E863560C9E7F790032F850AE9D04
- MD5 SHA1 SHA512 SSDEEP TLSH