6d70cbc7928a76e50805451d9666b58f9ba44dfa667bfcde23b42b262d91a89a.7z
- SHA256 06fa0e4eaf56de4aac42c422336eb958be1e9214f1773c45bacae8559020efdf
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d70cbc7928a76e50805451d9666b58f9ba44dfa667bfcde23b42b262d91a89a.7z
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
6d70cbc7928a76e50805451d9666b58f9ba44dfa667bfcde23b42b262d91a89a.7z
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 6d70cbc7928a76e50805451d9666b58f9ba44dfa667bfcde23b42b262d91a89a.7z
- Size 3.5MB
- Sample260916-kk7nmsac45
- SHA256 06fa0e4eaf56de4aac42c422336eb958be1e9214f1773c45bacae8559020efdf
- MD5 b5d7f7fb673557d23d287ee142038fe3
- SHA1 76abc764cdc94f53831b60dc598943c271e28759
- SHA512 db302bdb1158eb64b2b56330128ea11b341c6f00999177cf740f26c871c78a64983d9212b7b48470148d637ed310cc399c6dc4a995c76361d94abb679412a0f6
- SSDEEP 49152:UsCLuYqnXEFbqHdxhIBQf/EowXvKdbVPPkng0qZi06wSjCe4VzYB20LN+3/Gc1d:Tsfqn6wZf//eKLPknFcb/8BBE+c1d
- TLSH T18A06339C017EB2C5C805AA443D66C17F980C5FAE482A70F6F15BC3AB564C257EDF722A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6d70cbc7928a76e50805451d9666b58f9ba44dfa667bfcde23b42b262d91a89a
File Explorer
-
6d70cbc7928a76e50805451d9666b58f9ba44dfa667bfcde23b42b262d91a89a.7z.7z 3.5MB
-
6d70cbc7928a76e50805451d9666b58f9ba44dfa667bfcde23b42b262d91a89a.exe 7.1MB
6d70cbc7928a76e50805451d9666b58f9ba44dfa667bfcde23b42b262d91a89a
- IMPHASH 6e9ca36d37dab1583045cac9623ba145
- SHA256 6d70cbc7928a76e50805451d9666b58f9ba44dfa667bfcde23b42b262d91a89a
- MD5 d1fd876f84cfa85ca8487aad52da0135
- SHA1 d2eabbb4165bb62345b7115faeaf95ce08df0963
- SHA512 05e2112bd74ad4e3066d33c4dd048f078015949191d9d2ec748754ea12c0f3296071746be79d68dead3a445693ad5d351823e6c1efe6a7a6539587b097deb343
- SSDEEP 49152:gDkEPJq1ox9XPcfZMU9kidgLClZ2a1fsQP3ECeWS5kjnONm+P67MMtOV4/vqlfMo:yksOEpAMwdOYfhsB5kr2M7RQeKl
- TLSH T16C763307C58882F9C4EECA7047909639E93F709247F09AAF73A506327F26251AD2D75F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
167632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
kernel32
GetSystemTimeAsFileTime
SetFilePointerEx
GetCommandLineW
CloseHandle
FindClose
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
GetLastError
CreateDirectoryW
SetLastError
GetFullPathNameW
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileExW
CreateFileW
SetFileInformationByHandle
GetCurrentThread
GetModuleHandleA
GetProcAddress
GetModuleFileNameW
GetEnvironmentVariableW
CopyFileExW
GetCurrentProcess
DuplicateHandle
CompareStringOrdinal
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
CreateThread
GetExitCodeProcess
FindNextFileW
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
WriteFile
TerminateProcess
GetModuleHandleExW
GetCommandLineA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
SetEnvironmentVariableW
SetStdHandle
GetFileType
GetStringTypeW
ntdll
RtlNtStatusToDosError
NtOpenFile
NtCreateNamedPipeFile
NtWriteFile
Name
.text
Size
209KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6.7MB
Virtual Size
6.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
250KB
Virtual Size
254KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=7, id=259, version=27412,
count=137, id=261, version=27412,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=39, id=261, version=35207,
count=5, id=257, version=27412,
count=111, id=1, productName=Unmarked objects,
count=4, productName=Unmarked objects (old),
count=1, id=258, version=35217,