433_4_NoSpread_NoRe.rar
- SHA256 8919f03edec62a9f49dacc5df940cc821909743d70931d8758850f9f8a0256e0
Behavioral task
behavioral1
Sample
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/Инструкция.url
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/Инструкция.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 433_4_NoSpread_NoRe.rar
- Size 143KB
- Sample260912-pmj3kshj7x
- SHA256 8919f03edec62a9f49dacc5df940cc821909743d70931d8758850f9f8a0256e0
- MD5 9ae6810457013313e99ac9f549976d21
- SHA1 88f4d7e61937bcb892deb0f3c4f08c48a8434e05
- SHA512 b0efdc96f3c635b87d3359cd1a2783e2d060dfa1693e0261230e0b5da66c17e99c9a72ba9f411ea72c15b38f18c5d9e0f1e893ad5094219f0ea4bd69633fca65
- SSDEEP 3072:Fx57rh7iE2XYysnqRaw37SMJqsv2z9SNMgFdjwge/:FxVhiB5snKX3+sv29ypvwgs
- TLSH T1E8E312C8FAC8824FC4D516F6058CBF9D0C3768C6C4B136DA5832DCB6BA9C653AE49167
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.dll unpack001/NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.exe unpack002/out.upx
File Explorer
-
433_4_NoSpread_NoRe.rar.rar 143KB
-
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.dll.dll 93KB
-
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.exe.exe 283KB
-
out.upx.exe 262KB
-
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/Инструкция.URL133B
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.dll
- SHA256 f27548ec0ef80b352949709a37743054fc9288a9833760b75b64dd9579f412f9
- MD5 3b176ee12e468acb0c4a13b14a70b92b
- SHA1 5379ee98411cdf8e5c17b3add100aa432a92968b
- SHA512 8ba3ee3770ad0bb38a401adddd7b3d6afadb4ec0721b2f10ba863892e0d0928af3c62fb3515c9cf4a07f4e4cae3f82e9d9e63e683bd0a8c441618d6c1da8b057
- SSDEEP 1536:o7qtQMqIroT6E90li/lJcQTlpZ5FPc5yxPi06YEq4d4Sgx:Z1gB6I/TTlpBPc5TK84Sgx
- TLSH T196934D03F386C47CD0A4197C6E18FBC1967B762B2D6C21E7FAE4675FA9E93800465683
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
78820
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/nospread.exe
- SHA256 30bf19c346b2a32bb6ed5b21625de6023553be13b02565afacb83b20136229d4
- MD5 a315a1ca326eb0e1689989e0c2985c6c
- SHA1 dae1c970c501f85703579ad03f162b8e1eaa087b
- SHA512 f93c40203b00c1b1dc6b1e4b329e74175fdf399281691e5d32f67f059b2dc5a47604541f8b23d4ab89eb7dfede1db3d335a775d02bbdd2574d2506fc9bb988c5
- SSDEEP 6144:GpfXJ+hDMcMCH2FQwxE/HmVdCsH2M6PrzpvIKEdTzuhOChC38usHfJY6En6T2TSN:GpflcjHIQdU2hcEiP/3IWVJ/uxdcB7g
- TLSH T1D65474D32ACF0C96C9D277B8E1C71302B73CADB18B5B9BA7651845378E836C5AD85B01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
304368
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
74KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX2
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 529d82555ef4468dceb40b819028ec3e0a1e96fe09acff89221cb83dc2cb47ce
- MD5 164acad8b4b0c2a8ec3f8c8a3487c293
- SHA1 dd7b6fc7e1efade0455847969ea6d70a797f67ee
- SHA512 66c746c9a2b5f47332bb078123798c3d185f065e6a66d2f83c4c6506e70f253c13efe5b0da4c768d1b6efd3094dfd8260c300159294fa8c5a2283f91c4d1aa51
- SSDEEP 6144:XWUMLGyg9MBn7T4Mk9gCDvfjZAxDMLFa6eHuuMkExhpNJLQhfyVtEP4h:pqGyg9MBn7T4Mk9gCDvfV+Mpa6eHu1Fp
- TLSH T15E44E822BB0608F9D97315F149473BBB86308A2D4022C61AE794DD5EFBF75A17A3D342
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4640
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
248KB
Virtual Size
247KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
NoSpread_NoRe[tkznani9.at.ua]/Антиотдача + антиразброс [NoSpread + NoRecoil]/Инструкция.URL
- SHA256 bc3c4cd99fc2d9bb7ae7f91843fca6959f5fd382d2270abe1678bf794ec66c95
- MD5 d8e6efdc25c1a8ce9c51d75d01c4bf6e
- SHA1 bf6532643073a8162c877685bfdc16b5e78c38b7
- SHA512 ab9fa23b7b57aba33234191752e17ccb746111eae9d09edb1a0de3e3579a9f8468e0b985c763060c5e62f3789da917f99b1b4d60cd021f8b9b5b6656aa9464a4
- TLSH T152C02B34014881F5C00284096070F5804C0D34E004C3F48CB0D0CEC81C19008C04EF89
- MD5 SHA1 SHA512 TLSH