s.rar
- SHA256 b0f541b348df95098d71d34e9df6030e96943e159b4022771074ae2e3eb0c6bc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
s.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target s.rar
- Size 2.9MB
- Sample260910-pe2bwsbq7s
- SHA256 b0f541b348df95098d71d34e9df6030e96943e159b4022771074ae2e3eb0c6bc
- MD5 9fbe37179f58d91fcbe391f9a05b927c
- SHA1 099883c8cf21df172f052c2ca7aecbb7e3d9cbb9
- SHA512 893752336b4369a0ee9a18758b1ecc86ed990cc8fa11c583141d81baf6feecb42cbf60b1066a7037e6c11addca8928fddbe4ab8045d29c19bf9a439377d0d55c
- SSDEEP 49152:KrhMEwOcM2qJptQ4gQjnVrKDswLRIUY7HUiLupz7HlY15bbtLIQ4C6A+tGZ1:KrhMEwHkWMr1KhIr7HUxRgtRIPA+tGZ1
- TLSH T12AE5332722892DDDF62D0964C8F2B8C6D41276A352104E9310DBB917A6373E3F99FC2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loader.exe unpack001/internal.dll
File Explorer
-
s.rar.rar 2.9MB
-
Loader.exe.exe 3.3MB
-
internal.dll.dll 5.0MB
Loader.exe
- IMPHASH bb9190eec3848cc0757b855aeb0d5447
- SHA256 ac830ec489ce5bd3ba66c24b09f58dadb30bcd3b41cfc4fe90bbc35c8ea90fbe
- MD5 629a0c39cc5515b916d45ffc998a2db9
- SHA1 c7643db6c8b980b0e9a6036619f8fa4f900ce72c
- SHA512 b346bca08f2687366cb9ab4112d7d36bd2b89b2352d7cd8dc5d38e5181011107889b9bef3012de556908a9fcef2b420fba74c41a05095edd5d196b66cd4a7fb9
- SSDEEP 98304:2oSB7ZJXD+CK4bn5yy8EzmBmhzA2ZpXGP:pMZJXD+CK4bn5yyFmBmhzA2ZpXG
- TLSH T1E5F5AE46B3B841F8D16BC178CA56561BE7B2B454132097CF13A08BB92F63BE16B7E341
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1157848
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
send
WSACreateEvent
WSAEnumNetworkEvents
getsockopt
connect
gethostname
WSAEventSelect
ioctlsocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
select
__WSAFDIsSet
WSAIoctl
WSASetLastError
setsockopt
recv
getsockname
getpeername
WSAResetEvent
bind
accept
WSACleanup
WSAStartup
ntohs
socket
htons
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSACloseEvent
iphlpapi
if_nametoindex
crypt32
CryptStringToBinaryW
CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertFindCertificateInStore
PFXImportCertStore
CryptDecodeObjectEx
CertFreeCRLContext
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertFreeCTLContext
CertFindExtension
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
secur32
InitSecurityInterfaceW
kernel32
FlsFree
FlsAlloc
HeapAlloc
ReadConsoleW
HeapReAlloc
HeapFree
VirtualProtect
FlsSetValue
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetDateFormatW
SetStdHandle
GetConsoleMode
GetModuleHandleW
GetModuleFileNameA
WriteProcessMemory
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32NextW
LoadLibraryA
Process32FirstW
CloseHandle
VirtualProtectEx
GetProcAddress
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
lstrcmpiW
RemoveVectoredExceptionHandler
GetLocaleInfoA
MultiByteToWideChar
QueryPerformanceFrequency
GetSystemInfo
IsDBCSLeadByte
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
OutputDebugStringA
GlobalAlloc
SetEndOfFile
GlobalLock
WideCharToMultiByte
GlobalUnlock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SleepEx
GetTickCount
GetLastError
SetLastError
CreateFileW
GetFullPathNameW
MoveFileExW
WaitForSingleObjectEx
CreateThread
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
VerifyVersionInfoW
FormatMessageW
GetFileSizeEx
LocalFree
GetTickCount64
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
WriteFile
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
LCMapStringEx
GetCurrentDirectoryW
FlsGetValue
OutputDebugStringW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
DeleteFileW
HeapSize
GlobalFree
RtlUnwind
ExitProcess
WriteConsoleW
GetModuleFileNameW
SetFilePointerEx
GetConsoleOutputCP
RtlPcToFileHeader
RaiseException
GetCurrentThreadId
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
user32
GetClipboardData
SetClipboardData
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
CloseClipboard
SetCursorPos
GetCursorPos
SendMessageW
GetActiveWindow
ReleaseCapture
DefWindowProcW
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
PeekMessageW
SetLayeredWindowAttributes
TranslateMessage
PostQuitMessage
UpdateWindow
OpenClipboard
EmptyClipboard
IsWindowUnicode
DestroyWindow
advapi32
CryptImportKey
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptAcquireContextW
shell32
ShellExecuteW
d3dcompiler_47
D3DCompile
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
bcrypt
BCryptGenRandom
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
706KB
Virtual Size
705KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=196, id=261, version=33140,
count=25, id=260, version=33140,
count=16, id=259, version=33140,
count=3, id=253, version=35207,
count=18, id=260, version=35207,
count=17, id=259, version=35207,
count=95, id=261, version=35207,
count=168, id=260, version=35219,
count=8, id=257, version=33145,
count=18, id=257, version=33140,
count=3, id=156, version=21202,
count=302, id=1, productName=Unmarked objects,
count=9, id=265, version=35213,
count=1, id=255, version=35213,
count=1, id=258, version=35213,
internal.dll
- IMPHASH eef7dbf6f9129e7cdcc4a04160bb7e51
- SHA256 20d4ed3ef0c5e2067ba70b85e399ebfc1e1820287a02c6cffa0fd21b7a0af42a
- MD5 3eb3390eb8a10a72a60364b0c2b78fe5
- SHA1 fbcfeb80c3703842ceccb8f2cb5f29652082774e
- SHA512 52b2bb2c5ab18b11e3a0d3171704a6a487eac47a1b6339979c63a4c792f101d1c540671463ee17431458ed82cc12c5ed7998724abeda5e9154dfb2a40358cf01
- SSDEEP 49152:hVvUVNTxBE2N7KB9nMflVH+f8IGzTfQ1Srtp4YuBXowuxhLzkTO2CEmLg1pk3njn:/vUVNTxi56DHC6UQPuBXoxRoTkg83j/
- TLSH T1D436BF13F74251ADC52AD53886AB9322B331B8059B3257CB66482F35ADD33E01F3ABD5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1047808
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Desktop\velocity-main\cs2\velocity-cs2\..\bin\cs2.pdb
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AreFileApisANSI
CloseHandle
CompareStringW
CreateDirectoryW
CreateFile2
CreateFileA
CreateFileMappingA
CreateFileW
CreateThread
DecodePointer
DeleteCriticalSection
DisableThreadLibraryCalls
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoEx
GetLocaleInfoW
GetLogicalProcessorInformationEx
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetTickCount64
GetUserDefaultLCID
GlobalAlloc
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExW
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEndOfFile
SetEnvironmentVariableW
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
WaitForSingleObject
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
shell32
SHGetFolderPathW
user32
CloseClipboard
CreateWindowExA
DefWindowProcA
DestroyWindow
EmptyClipboard
GetAsyncKeyState
GetClipboardData
GetCursorPos
GetSystemMetrics
GetWindowLongPtrW
LoadCursorW
MapVirtualKeyW
MessageBoxA
OpenClipboard
RegisterClassExA
SetClipboardData
SetCursor
SetCursorPos
UnregisterClassA
advapi32
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
ole32
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal
api-ms-win-core-synch-l1-2-0
WaitOnAddress
d3d11
D3D11CreateDeviceAndSwapChain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
965KB
Virtual Size
965KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2.0MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_addr
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
232B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ