KIRRA_SPAM.zip
- SHA256 3f5b9e5aa0fd3d663e48bfb1b50c250a76680d47edd1e569c5eb85efdad1445a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kirra_Spam.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Kirra_Spam.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Kirra_Sweep.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Kirra_Sweep.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target KIRRA_SPAM.zip
- Size 30.6MB
- Sample260916-xffetavakb
- SHA256 3f5b9e5aa0fd3d663e48bfb1b50c250a76680d47edd1e569c5eb85efdad1445a
- MD5 b78f98b02467cd35b7e00d917e0840c2
- SHA1 01651a76bb4aa8c3748c8e720c130b38de3fec55
- SHA512 593e46ec56a9cc851540d6bf32919d9463aeecf40e6e42580184d005be254fb6998b6d55e97f4fd059eea102a59c826735688cf68c406f7eb1825b5cad4491e1
- SSDEEP 786432:FWwEmVIwhhn/ZXEWHwV6L4VIQD84uSTeExX3NR1mzpyc3p:FWwEMIEn/BECS6LYgSTemX3NR1mzpyc5
- TLSH T1F167336E2BC719EFDF98DDB42497E50BE3A742DE60F94A2933E710DC4A140E45BA0931
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Kirra_Spam.exe unpack002/Kirra_Sweep.exe
File Explorer
-
KIRRA_SPAM.zip.zip 30.6MB
-
KIRRA_SPAM/Kirra_Spam_v1_0.zip.zip 30.6MB
-
Kirra_Spam.exe.exe 23.4MB
-
Kirra_Sweep.exe.exe 7.6MB
-
README.txt996B
KIRRA_SPAM/Kirra_Spam_v1_0.zip
- SHA256 3657107cd0dadbad69136a0e78d748e9a8fa49c7f997057fb8badc20b92f65a5
- MD5 7a6a69ff392066fa5fb9978ccec2f59e
- SHA1 add973d781f90c9ce34983d6666b578a0e827e73
- SHA512 a1287001b4930bdee43b6c37e9226bb68c17348126b2b8138548e125dc78806b66d06fe426fb714064b919d0a251861e0c8df43c330b11d1aa532a604c4296bb
- SSDEEP 786432:OWwEmVIwhhn/ZXEWHwV6L4VIQD84uSTeExX3NR1mzpyc3B:OWwEMIEn/BECS6LYgSTemX3NR1mzpycR
- TLSH T13D67336E2BC719EFEF98DDB42497E50BE3A742DE60F94A2933E710DC4A140D45BA0931
- MD5 SHA1 SHA512 SSDEEP TLSH
Kirra_Spam.exe
- IMPHASH c63db87cf03479408d0546f4c515498a
- SHA256 6ab089ce9b2653f704fea49aa79572c0e7285d99a3dd1f4efb0de0a37fe46e5d
- MD5 a197ea5531ce2b2cab03470e8840a2d3
- SHA1 4657438706cc05a0716e2febcf43e8704836651e
- SHA512 c8208e3dbd4dccc7455df5059ca2ebdd3381aa215e03715d13713b900d6ad280a4eb4aee2d151e882723ac56f3f5dca69c96c40abef7ef98ff10df7a7e188af7
- SSDEEP 393216:c1OioUiK9mbrj5deHpydVhDVZnHgqsTSIOJi03mQu3S//3b7gM8y1vhbXMX+7gZ:c1Oimnju4dLDVFHts2IOg03mA/3bkk7a
- TLSH T1B637333B6BD349FED387CFB817A1F23BE1BC59B53835891A925274D8BB30A486B54110
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4119
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddDllDirectory
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateProcessW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FormatMessageA
FreeLibrary
GenerateConsoleCtrlEvent
GetCommandLineW
GetCurrentProcessId
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
GetProcessId
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathW
InitializeCriticalSection
IsDBCSLeadByteEx
K32GetModuleFileNameExW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
MapViewOfFile
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
ReadFile
SetConsoleCtrlHandler
SetDllDirectoryW
SetEnvironmentVariableW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__argc
__iob_func
__set_app_type
__setusermatherr
__wargv
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_unlock
_wcmdln
_wcsicmp
_wcsdup
_wrename
abort
atexit
calloc
exit
fprintf
fputc
fputwc
free
fwprintf
iswctype
localeconv
malloc
mbstowcs
memcpy
memmove
memset
puts
signal
strerror
strlen
strncmp
vfprintf
wcschr
wcscmp
wcslen
wcsncmp
wcstol
shell32
CommandLineToArgvW
SHFileOperationW
SHGetFolderPathW
Name
.text
Size
128KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
23.0MB
Virtual Size
23.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
266KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Kirra_Sweep.exe
- IMPHASH 476e6a48b25dbee1eff7b5d0a4cd4b15
- SHA256 4a6c7cb4876723988a921a120418ac9eefe576ff41b1c8931a16972b6efaf52e
- MD5 1ebfc3efbea9cda1b80a47980747cc62
- SHA1 f5ba9510b038b0394d39a14d3f027cea99496668
- SHA512 eab51e149a6003d82f3f5db75fbc4f7f7ba6c729a7fd5c59a6485011da697447e0d9e1d4bbf20ed3f681a98a9220bf06534e48ac28ee195f33c0abb11cf97f15
- SSDEEP 98304:Oqb100T3JNpsduHzAd1DFpIdhahHty1sYI7QQInxMfDRzKFLyBl9vQYCTNdc0ikF:Z607psakPzYhePlIxMbRr9vJCZifUY
- TLSH T1808633A95FD7A44ECB03A3BC79E6F3BA707DDAE034019703C5612564BFB1EA86D80095
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4166
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddDllDirectory
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateProcessW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FormatMessageA
FreeLibrary
GenerateConsoleCtrlEvent
GetCommandLineW
GetCurrentProcessId
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
GetProcessId
GetShortPathNameW
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathW
InitializeCriticalSection
IsDBCSLeadByteEx
K32GetModuleFileNameExW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
MapViewOfFile
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
ReadFile
SetConsoleCtrlHandler
SetDllDirectoryW
SetEnvironmentVariableW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wargv
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_unlock
_wcsicmp
_wcsdup
_wrename
abort
atexit
calloc
exit
fprintf
fputc
fputwc
free
fwprintf
iswctype
localeconv
malloc
mbstowcs
memcpy
memmove
memset
puts
signal
strerror
strlen
strncmp
vfprintf
wcschr
wcscmp
wcslen
wcsncmp
wcstol
shell32
CommandLineToArgvW
SHFileOperationW
SHGetFolderPathW
Name
.text
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
7.2MB
Virtual Size
7.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
266KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
README.txt
- SHA256 4c7818712b6b110d0ddd3157640206d0385b04dee28d674fcbedb28bd8d9a8ab
- MD5 6a1b6f06af3eb948d92a8c166d1202c0
- SHA1 eb240142bd44cc9b521b74a459ac1eaa22ef8262
- SHA512 a8e9b7e89b89ce76932f6b9640843708a5f38ba0ce2c25269406c363889ad80ff7d7d56a19556429fd154da345a519e86be1c5024a7b8eea0904d211290c9bca
- TLSH T17E11588EDFEE325E17C0646AE012AF533619B07D23ED89B04448C74F123176B557D9B5
- MD5 SHA1 SHA512 TLSH