4cb80e52cf476913a291629e994c4a584ce1c1c40247b54941691acfe91275b5.zip
- SHA256 aad38ff3765c6c29ff0a53ccd0b67581e829a1cb786e1892d6c1098284ad8bb6
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4cb80e52cf476913a291629e994c4a584ce1c1c40247b54941691acfe91275b5
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 4cb80e52cf476913a291629e994c4a584ce1c1c40247b54941691acfe91275b5.zip
- Size 390KB
- Sample260909-vaxe2aybla
- SHA256 aad38ff3765c6c29ff0a53ccd0b67581e829a1cb786e1892d6c1098284ad8bb6
- MD5 d21b1834d01bc8f14144704c9cadd512
- SHA1 77f649cad674b1281dd50f63e323ad5afaf2f41a
- SHA512 cfca286aabd1db63b5f2cc9c32dbd6ff3250ee2ee992261d8c891712f24582076b126f1096eafa798adf5a44cc3f1761efe2f5f507b8b05b5b7ac0e419722eca
- SSDEEP 12288:9w/7IHa2qmv0rpXxb2jEaAhXK2v9PlW7RToV5jf:9s7FrpcPA9K2ldaV85jf
- TLSH T1228423D1405422DF79A62525A84EDED8E0F0ADB77275EF02603DE5F204A1A423E34BDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4cb80e52cf476913a291629e994c4a584ce1c1c40247b54941691acfe91275b5
File Explorer
-
4cb80e52cf476913a291629e994c4a584ce1c1c40247b54941691acfe91275b5.zip.zip 390KB
-
4cb80e52cf476913a291629e994c4a584ce1c1c40247b54941691acfe91275b5.exe 518KB
4cb80e52cf476913a291629e994c4a584ce1c1c40247b54941691acfe91275b5
- IMPHASH 0ac3120ae68ed7903602d5b782c1add4
- SHA256 4cb80e52cf476913a291629e994c4a584ce1c1c40247b54941691acfe91275b5
- MD5 79b49db1b1263458c985495795fc35a0
- SHA1 6c6f4788722a9bc13385a3258eb7779f50122de3
- SHA512 13683d5c319c9afb82362b440308cdd3659cac1f25e1dadd2bcd49d4a30ebd92037e5366daaebdbdad51b4373d41a0f9e939ffc8a74f16a55493d5560fc3b31c
- SSDEEP 12288:eVDDG9JgQTxOZi+RTIBDftodc80EAyUyAL302:e5DG9tTxb+RTUf9EjUh
- TLSH T150B4E051BAA913FAD16FC038C4811506E7B3785A5751AEDF13A00AB71F23AE49E3F712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
84872
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantInit
kernel32
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
FindClose
GetLastError
GetTickCount
lstrcpyW
lstrcatW
lstrlenW
GetLocalTime
lstrcmpiW
FileTimeToSystemTime
SystemTimeToFileTime
WideCharToMultiByte
GetCurrentProcess
TerminateProcess
GetModuleHandleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetFilePointerEx
GetModuleFileNameA
GetProcAddress
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
Sleep
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetSystemTimeAsFileTime
CloseHandle
WakeAllConditionVariable
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
LCMapStringW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
user32
EndPaint
BeginPaint
UpdateWindow
CreateWindowExA
FillRect
PostQuitMessage
DefWindowProcA
LoadCursorA
DispatchMessageA
TranslateMessage
DrawEdge
LoadIconA
GetClientRect
RegisterClassExA
PeekMessageA
gdi32
GetStockObject
Name
.text
Size
167KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
333KB
Virtual Size
336KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=176, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=89, id=261, version=35207,
count=13, id=257, version=33145,
count=175, id=1, productName=Unmarked objects,
count=1, id=262, version=33145,
count=12, id=260, version=35225,
count=8, id=261, version=35225,
count=1, id=255, version=35225,
count=1, id=258, version=35225,