ItemSettings.zip
- SHA256 1304352bf4079fbcb8344ecdf39b7847696e2e41028aba93aa2ef11ff4b0a829
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ItemSettings.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
600 seconds
Behavioral task
behavioral2
Sample
ItemSettings.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
General
- Target ItemSettings.zip
- Size 22.5MB
- Sample260910-rn8tfayvds
- SHA256 1304352bf4079fbcb8344ecdf39b7847696e2e41028aba93aa2ef11ff4b0a829
- MD5 36155712d32a62530be2b6e8a1f04eff
- SHA1 783fd88508c59d1d28064a7d5ef796419999b213
- SHA512 292ac4a6069dbc5a5005248c509bdf599f1479b8ef61288e6e9328994f850e11d3ed949972836799922bae8ca7d297a513d43a77da6bc8374fddc3389e657a5c
- SSDEEP 393216:m7d2WVG2gK/IqiM3wHaaPlKDJOfXU2EakLLJFfRq2EXbFWA9IwhG/Rp7pAnJt1:m7XGaIqpWtKDJ0XaakLlFZuLFL9IwY/Y
- TLSH T122373308F62D565FB8F426D8263D9AA6368251CC1C7EF9CA75A019DEA0CE7110CCC6DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ItemSettings.exe
File Explorer
-
ItemSettings.zip.zip 22.5MB
-
ItemSettings.exe.exe 26.7MB
ItemSettings.exe
- IMPHASH 02c546b08b9a7df89e630d8f09a4a671
- SHA256 b645ee90b5ad220cbb26ef7dabaef5a15ead676e71685d7ccf832d80bed06048
- MD5 73dde6fd26ffe2a6039544f64197a857
- SHA1 457bb4014413d95dd15f12fe80a3c9bc94653109
- SHA512 bcdb4139b15d333440a9f964d4a3c6e5766f7618ca1409d7fa4af2c151c216d86e7329d3abcc4cc1f88ec4a88eb71cacdd8a19dbb619a84e17e3b79a1ae8650c
- SSDEEP 786432:l7TqJiDE+I0lsNTcCsMtB/DqLvhNsaKjhtTa/:ln4iJ/sTYbXK/a/
- TLSH T12D5712D5689052ECD362C239C28AEAEED3D5745A9EF2571F7FC240022531D82DDE2D3A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
31157286
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
Process32NextW
user32
LoadIconW
gdi32
GetStockObject
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CoSetProxyBlanket
oleaut32
VariantInit
bcrypt
BCryptEncrypt
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
Name
.text
Size
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
404KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.0iA
Size
Virtual Size
17.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.#.O
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
..}f
Size
26.5MB
Virtual Size
26.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
234KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ