executables.rar
- SHA256 5a90cae7869f6000e575a070214fb2ba57577a92e9824b2ea57ecf3fa4145d43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
executables/loader-cracked.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
executables/loader-cracked.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target executables.rar
- Size 810KB
- Sample260910-prlrzack7z
- SHA256 5a90cae7869f6000e575a070214fb2ba57577a92e9824b2ea57ecf3fa4145d43
- MD5 ae331145b9efbf31d4a014ceb29c58e7
- SHA1 71c4077f82bea445a7b8420feef4e30c9cbfc347
- SHA512 92d76302004a573db949cd8fdeaec02120427829dc205f37a2ebed8c83534eaa3b8b86e67b09468d07be299f0b5e8b6e75573fd52ec17ae7d082a66895613120
- SSDEEP 24576:HDEXpF9mX00AAoR1CVhqxE4DvQ2hoNIkx:jWIX0HAyHE478fx
- TLSH T1B10533416E273B62BDDE4C2FE699454F7B388D8AC10237197DE4B0A4155BEB8C70F252
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/executables/loader-cracked.exe
File Explorer
-
executables.rar.rar 810KB
-
executables/loader-cracked.exe.exe 1.8MB
executables/loader-cracked.exe
- IMPHASH 1ab7f90e706300fd453fc0ea63d13545
- SHA256 330b6fef24500765145ecb0afece808f67d0ae12595598a391cbcaee50f02637
- MD5 142884e1606742ec520e3f8b14ea5724
- SHA1 8ba108645b57f9168ff71288ff5b013e5157d3f7
- SHA512 5aef7e3b71cbeb70ae0d94056444b2c535d126e9df9688801b3568b2a64fe3728129e3a7a65209bf672eb421b5ca12bcf9c5d54315c1d0fa97e4877a76e3f3ef
- SSDEEP 49152:3vslNqIqNhY07DxI/Wl3VwMf+NWNarsAn3bj:UjqIEfI/Wl3VwMf+NWNw
- TLSH T19585AE5A66F400F8D1B7D07CC557AA0BE6B2740D03609ADF13E44AA92F637E16A3F712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1181088
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
VerifyVersionInfoW
GetFileSizeEx
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetEndOfFile
SetStdHandle
GetTimeZoneInformation
CreatePipe
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetExitCodeProcess
WaitForSingleObject
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetCommandLineW
GetCommandLineA
WriteFile
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
VirtualQuery
CreateProcessW
DuplicateHandle
WaitForSingleObjectEx
ExitThread
GetModuleHandleExW
VirtualAlloc
LoadLibraryExW
TlsFree
TlsSetValue
GetSystemInfo
LoadLibraryW
GetSystemDirectoryW
LocalFree
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FormatMessageW
SetLastError
QueryFullProcessImageNameW
GetModuleFileNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualProtect
CreateThread
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
AddVectoredExceptionHandler
DecodePointer
GetLocaleInfoA
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
VerSetConditionMask
MultiByteToWideChar
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetTickCount
FreeLibraryAndExitThread
GlobalFree
GlobalLock
RtlUnwindEx
RtlPcToFileHeader
RaiseException
OutputDebugStringW
GlobalUnlock
GlobalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
RtlUnwind
SetConsoleTitleA
SetConsoleCtrlHandler
WideCharToMultiByte
MoveFileExW
lstrcmpiW
GetModuleHandleW
GetModuleFileNameA
GetWindowsDirectoryW
Sleep
SleepEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
LCMapStringEx
EncodePointer
WakeAllConditionVariable
GetSystemTimeAsFileTime
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
DeviceIoControl
GetLastError
CloseHandle
RemoveDirectoryW
DeleteFileW
CreateFileW
WriteConsoleW
ExitProcess
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
FormatMessageA
GetLocaleInfoEx
GetCurrentThreadId
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
user32
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
GetAsyncKeyState
GetKeyNameTextA
MapVirtualKeyA
GetSystemMetrics
UpdateWindow
GetClientRect
GetCursorPos
ScreenToClient
GetDesktopWindow
MonitorFromPoint
BlockInput
OpenClipboard
CloseClipboard
CreateWindowExW
GetClipboardData
EmptyClipboard
GetKeyboardLayout
TrackMouseEvent
GetMessageExtraInfo
GetKeyState
GetCapture
SetCapture
ReleaseCapture
IsWindowUnicode
GetForegroundWindow
GetDC
ReleaseDC
SetCursorPos
SetCursor
ClientToScreen
LoadCursorW
SetProcessDPIAware
MessageBoxA
RegisterClassExW
SetClipboardData
TranslateMessage
UnregisterClassW
PeekMessageW
DefWindowProcW
PostQuitMessage
DispatchMessageW
gdi32
GetDeviceCaps
advapi32
CryptHashData
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerA
OpenSCManagerW
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
RegCreateKeyExA
RegDeleteKeyA
SetSecurityInfo
CopySid
ConvertSidToStringSidA
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
OpenServiceW
QueryServiceStatusEx
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptDestroyKey
SystemFunction036
CryptDestroyHash
StartServiceW
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CryptStringToBinaryW
ws2_32
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
getsockopt
WSAGetLastError
inet_pton
ntohs
WSASetLastError
inet_ntop
WSAStartup
WSACleanup
bind
connect
getpeername
closesocket
htons
recv
setsockopt
socket
WSAIoctl
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
gethostname
getsockname
shlwapi
PathFindFileNameW
psapi
GetModuleInformation
userenv
UnloadUserProfile
bcrypt
BCryptGenRandom
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
345KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=209, id=261, version=33145,
count=38, id=260, version=33145,
count=24, id=259, version=33145,
count=7, id=253, version=35207,
count=10, id=259, version=35207,
count=18, id=260, version=35207,
count=102, id=261, version=35207,
count=43, id=260, version=33523,
count=129, id=260, version=32535,
count=5, id=261, version=35221,
count=35, id=257, version=33145,
count=362, id=1, productName=Unmarked objects,
count=10, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,