Downloads.7z
- SHA256 67e849d4d3d594e6cf0568935eee7d7faa09ead147cf08820a1894c866b6c3c1
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Downloads.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
900 seconds
Behavioral task
behavioral2
Sample
Downloads.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
General
- Target Downloads.7z
- Size 76KB
- Sample260908-t68x9seq4x
- SHA256 67e849d4d3d594e6cf0568935eee7d7faa09ead147cf08820a1894c866b6c3c1
- MD5 9b163f6403707548181bb5b1f1714103
- SHA1 7e0c4b92578d12ddb632914950d9bc44c774db67
- SHA512 46f4363f6d813b60d8f19259a90d882312a40c4db8722b67ef134b69294ee90ef496f081118a29ff643423295af375da66ac87905b4af6b126fa902fde398733
- SSDEEP 1536:en0+Vy71y7XjLNoJqa6zN0MOj39LJUu8PnecloJdn:en0+ZPoL6g958PxE
- TLSH T10F7302D95C1CFA9891A346F74FBC7AC7280026FF08A04FE14DD9E59225D69DE523F062
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/IntelM.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack003/IntelM
File Explorer
-
Downloads.7z.7z 76KB
-
260828-hnqhesthrg_pw_infected.zip.zip 74KB
-
New folder.7z.7z 74KB
-
Autorun.Inf67B
-
IntelM.dll 105KB
-
IntelM.exe.exe 132KB
-
CDOC IntelM Remediation Final.txt.bat 4KB
260828-hnqhesthrg_pw_infected.zip
- SHA256 0068c23e048e7d871402965a00517a5a07b8de7cddfb7f761925c24573bf1983
- MD5 2fb0c3953d385616c21382131257247a
- SHA1 e0c73c7d5909a3051858fe5873d69bdacc007ccd
- SHA512 8be68d1509ed2c771f0e702a42949fbef7eebd89b26d4ccd7acea292445335e32c246582d41432c474035f34865cfa70efe1a5440335ad1400a8039aeb93925a
- SSDEEP 1536:Rn0+Vy71y7XjLNoJqa6zhbgLi0pCyXcERNcpC94X:Rn0+ZPoL6FqxVXceNcpC94X
- TLSH T1B77313A95C49F490C94405FF8B7CC3C6616522AE0A24DA7F1DD6F321260A7EF723B9B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
New folder.7z
- SHA256 d6459f318874866e7ea36591635b202590ff1a0b9c6b8b099b9ff2e4976721df
- MD5 49490a97c479e295987aebfdf7ed5f2d
- SHA1 56423b7455666a80356c27ee041b45fcda054f64
- SHA512 ee7fbb66f4e0ee315ebdcd97dc7b970664eb86e8a04c180edfc3ff82eccb5d8b8dc749f1b70430f35f036ea56d699e533b053d66e205d66ac9ef7bd17662887a
- SSDEEP 1536:o/F75LCoarN5P0Ik79H7q+sjhprYAZmtDbN6H:s8PP0T79bvslprYAYVbNC
- TLSH T1B2730256BBA207233A6D8D91D066FED65F0826F494F018D0CF26D6F300ABC9C638ED90
- MD5 SHA1 SHA512 SSDEEP TLSH
Autorun.Inf
- SHA256 91e185ca9a09af72823bb4a721837a064ea6b42621ebe6ddaf40e104687eb915
- MD5 460c7d573d142539977c61d4b5521f8a
- SHA1 a703ae5c0fcc769a823ae42b5c07b70df406edd1
- SHA512 4e55ce778ee7bd24d7a211411805b3bee4e7b7e17fb0e26bccedfc4c913e4775fb639fd7a9cce31e42a1db4bd94002a7274b926b1187ded8eb1597227684c876
- TLSH T17BA002C7A6AD66DA100EA400F39100A3EE83D59060914863D354DC9E33C42DC861AA99
- MD5 SHA1 SHA512 TLSH
IntelM
- IMPHASH cb0275eec9ac31b6d4d44320e576fadb
- SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
- MD5 9484c04258830aa3c2f2a70eb041414c
- SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
- SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
- SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
- TLSH T1A8B35C02B3E58171E5F22B300A361B61AFBEBD25AD31864BC354765D1E31B95EE3831B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
69:2a:36:1f:e3:5a:77:be:50:6d:5c:24:76:db:24:df
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
13:89:b4:d1:8a:e8:a7:c4:bd:35:c7:9b:8d:88:ca:1f:ca:53:56:91
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Subject
OU=VeriSign Time Stamping Service+OU=VeriSign Trust Network+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign\, Inc.,L=Internet
Serial Number
bd:11:9a:da:43:ed:21:fb:46:58:84:89:ca:46:88:90:25:ee:14:60
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Dec 31, 1999
Minor OS version
0
Major OS version
4
Entry point
4932
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
wsock32
accept
listen
inet_ntoa
recv
WSAGetLastError
WSASetLastError
select
__WSAFDIsSet
shutdown
ntohs
sendto
recvfrom
connect
getsockopt
setsockopt
getsockname
getpeername
closesocket
WSACancelAsyncRequest
gethostbyaddr
bind
WSAAsyncSelect
socket
WSAStartup
WSACleanup
inet_addr
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
gethostbyname
htons
gethostname
ioctlsocket
send
kernel32
lstrlenW
GetFileAttributesA
GetModuleFileNameA
InitializeCriticalSection
HeapFree
HeapAlloc
GetProcessHeap
lstrcpynA
lstrcpyA
lstrlenA
lstrcatA
IsBadWritePtr
WideCharToMultiByte
GetVersion
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
LocalFree
FormatMessageA
GetTickCount
MultiByteToWideChar
SetLastError
GetProcAddress
GetLocaleInfoA
DeleteCriticalSection
FreeLibrary
DisableThreadLibraryCalls
lstrcmpA
InterlockedDecrement
GetWindowsDirectoryA
LoadLibraryA
HeapReAlloc
InterlockedIncrement
lstrcmpiA
GetLastError
LockResource
LoadResource
FindResourceA
user32
EndDialog
DialogBoxParamA
GetActiveWindow
MessageBoxA
DrawEdge
GetDC
CharNextA
LoadCursorA
wsprintfA
GetWindowRect
SetWindowPos
ShowWindow
IsDialogMessageA
GetWindow
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
IsChild
GetKeyState
SetParent
WinHelpA
IsWindowVisible
EndPaint
GetClientRect
BeginPaint
SendDlgItemMessageA
LoadStringA
ClientToScreen
OffsetRect
EqualRect
IntersectRect
SetWindowRgn
PtInRect
MessageBeep
LoadBitmapA
GetSystemMetrics
GetParent
CreateDialogIndirectParamA
GetDlgItemTextA
SetDlgItemInt
SendMessageA
DefWindowProcA
GetWindowLongA
DestroyWindow
KillTimer
SetTimer
UnregisterClassA
RegisterClassA
PeekMessageA
PostMessageA
SetDlgItemTextA
SetFocus
GetDlgItemInt
MoveWindow
SetWindowLongA
CreateWindowExA
ReleaseDC
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CreateOleAdviseHolder
advapi32
RegDeleteValueA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
oleaut32
SysAllocString
VariantChangeType
SysAllocStringLen
SysStringLen
SafeArrayRedim
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
LoadTypeLibEx
OleCreatePropertyFrame
LoadRegTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SetErrorInfo
CreateErrorInfo
GetErrorInfo
SysFreeString
SysAllocStringByteLen
SafeArrayCreate
VariantClear
SafeArrayGetUBound
SafeArrayGetLBound
SysStringByteLen
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayGetDim
VariantInit
gdi32
GetDeviceCaps
CreateCompatibleDC
CreateRectRgnIndirect
GetWindowExtEx
GetViewportExtEx
DeleteDC
DeleteObject
GetObjectA
LPtoDP
SetMapMode
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
CreateDCA
BitBlt
SelectObject
DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
IntelM.exe
- IMPHASH 14a5ba63cc6389fe002bfd084bec42e2
- SHA256 84a65f6222f4f4951ee3607e7e1ebfb27da4017341ac79e6fa636c11ff6a1a76
- MD5 a5427d7a87c3117aca9ca290e75b46d0
- SHA1 8bfcfbd757b6a355b563a6e65782e85703596669
- SHA512 620f34759b4a4345989f14fdbfc5b10f7753ca6619f29b3404ce058139afe8f7c0813b6af97a7363b9711e9360dbed235e7540586c0c792c30a955ee7c5a7528
- SSDEEP 1536:0C74flkqtlg/GcEShjkDrWFC90Z/Q3y3WJXwerBwC:0LFt6/G+hoDr59OmZwetwC
- TLSH T122D3E733EA44854BF95289B12434A169382E7D35A5D4CD07B3817F6824B2AF3FCE5B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
ord620
__vbaRaiseEvent
__vbaFreeObjList
ord516
_adj_fprem1
__vbaStrCat
ord660
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
ord300
__vbaFileCloseAll
ord301
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord306
__vbaBoolVar
ord307
ord309
__vbaBoolVarNull
_CIsin
ord631
ord525
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord529
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
__vbaObjVar
__vbaI2I4
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
__vbaRedim
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord716
__vbaFPException
ord717
__vbaStrVarVal
__vbaVarCat
ord535
__vbaI2Var
ord644
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
ord648
ord570
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
ord610
__vbaAryLock
__vbaVarAdd
__vbaLateMemCall
__vbaStrToAnsi
ord612
__vbaVarDup
__vbaVarCopy
__vbaVarLateMemCallLd
ord616
ord617
_CIatan
__vbaStrMove
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
Name
.text
Size
112KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=6, id=9, version=8041,
count=1, id=13, version=8169,
CDOC IntelM Remediation Final.txt
- SHA256 3adb1d90ee91df2d36a93c0a13a95ac7659983c902655551f58b248dac9cfed7
- MD5 004acce2a497ec59158d1f62c1430a1c
- SHA1 3925684172a7c374557100722db74e6d533dc308
- SHA512 bb10dce45d663005206ccc8c87df21f69138656132e8f33fc76fbd60e5949f02570e4d8adbeda4d0965af54b168b9084fdbc892fbbaff005675148bb6e496aac
- SSDEEP 96:h53yvPppyUlUCkmGam6/24cYPu8UmLqQ0LSAQCasPgABvPuq:h5ivIo2mLqQ0YCfgEt
- TLSH T1B7A1668D3E0025948DFCC3866D9E0153FE17854B1675BFE548EB61BEA9467C402BFAA0
- MD5 SHA1 SHA512 SSDEEP TLSH