an.zip
- SHA256 26b35f04cd53782196ef2f56f1f0b37866f0b685c7e2e4c8b84495e01c91917f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
activate_srqz7q.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
activate_srqz7q.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
sechost_o4f32s.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
sechost_o4f32s.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target an.zip
- Size 162KB
- Sample260916-xa6d2ssxbv
- SHA256 26b35f04cd53782196ef2f56f1f0b37866f0b685c7e2e4c8b84495e01c91917f
- MD5 294f3c066e09a92e79842b886c20a730
- SHA1 1080f4827b330ca8939353d5d20248adfaec0dce
- SHA512 883ab172a6da46b1718b1037f7f54ed492e7502fa460d8997516e01fa7f97746fe5448515f3e99250edb6c134df3c48ccdd11b3d39b7a2106d1606f9e565754d
- SSDEEP 3072:TfaKfHIaqqBa5X4LJF++C68h9lN5OVoYITGTR3HWAkmTsu0ODazC8tM8:T1fESgXKJ58rlHOeETR3HWAkmTdLuzCq
- TLSH T109F3233A0DE866D8D0A3B57441CD013591BC616C1F262E7A7C05FEE9982D1EABCD07BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/sechost_o4f32s.dll
File Explorer
-
an.zip.zip 162KB
-
activate_srqz7q.bat.bat 129KB
-
own.enc75KB
-
sechost_o4f32s.dll.dll 14KB
activate_srqz7q.bat
- SHA256 207d964e8254633cff1059ed62c2cc9fe67cedd83094bb2b61b9a430f924749b
- MD5 36b2a81e046bdbcf438317f685f17d41
- SHA1 acf11ac10a46274783b865dd2b499a45c2aaa3ca
- SHA512 05d31b2b2e3f908109edabbe9bf52da4a343f41df2c2677c2826ca5aeb0791d32123f60fc34a420bd856e3708741399e13d2e5b2a978e00f29a931b1daf2c861
- SSDEEP 1536:ojAkqhm2N/8ptvCPNlDuzpn5zYhbZaOOvx2MQl+5mgnAlsTMbHGISlwq34Q2UjNd:o5qUtvINlkPyt2HP5mGbqml1Iend
- TLSH T167D3463D3F1569883E6E4946CE3C6858BC2FF9976BF0DC49A897F43621A54D87B0C508
- MD5 SHA1 SHA512 SSDEEP TLSH
own.enc
- SHA256 230b693565c103966ab2e05691554765a434628d672b37d757ea130eff2c8e21
- MD5 b0e9e38f8351a7ff5dcdea552e1b822d
- SHA1 63d9ec498a59a42d84956c07c86215f3fbbea723
- SHA512 ed5e36ecc5a6b28acad4f92d212018735e9c3401b32ec45fe743da7e9a58c96ba7d333957a7d7fe5db027a1d44b65a7ba0ee82ce46d33d28e8a634ecf4f43acd
- SSDEEP 1536:RyTps6WDW2DUCVPxvGTR3HeZGv8XmTcgqu7IycRfirfsIG8JdtrvecUOT9:cVo6ITGTR3HeAkmTsuufYsgrtrvXU8
- TLSH T1E073027D075E78E45581A6E1140FD23A85F48CD0AFEB25D9FD200DECE66D58EE7C8620
- MD5 SHA1 SHA512 SSDEEP TLSH
sechost_o4f32s.dll
- IMPHASH efd7f22fecb87f90fef74b8027a9ff28
- SHA256 8e248505b6cd87d2e27ed40541c2b2933113380da27bc75458d62d419e732f8d
- MD5 609148a3a0c5eff84a22ff8900a5afff
- SHA1 c253fdcb5e2b408832b9de61a8c6c553d2d712f8
- SHA512 54344cf339c8f465680bdae0d90917a230562b8afed83e92d6aeacb3079e651a128c9fb8a0463ea4d61564aecc976a724014bcea03b4b3fa65015668f54a46d5
- SSDEEP 192:qutinEng2LH7Ilv81KM2151/e3m0Sd4L:qutiegMH4gdWb/qSd4L
- TLSH T1D452B80D325388D9C54AC47991EB8FB8EAF5B901C5E75B388334DA363E607A5772AE01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4928
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateFileW
CreateRemoteThread
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetProcessHeap
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
OpenProcess
Process32First
Process32Next
ReadFile
Sleep
TlsGetValue
VirtualAllocEx
VirtualProtect
VirtualProtectEx
VirtualQuery
WaitForSingleObject
WriteProcessMemory
lstrcmpiA
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf
wcscat
wcsrchr
Run
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
67B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ