Hewski baba ayar.rar
- SHA256 34803a9d1bf35c2808cee0dd4b3300273c7e0f51afb6b693cb6baa37b4fb69e1
Password
okeymus3.
Overview
overview
6Static
static
3Hewski baba ayar.rar
windows10-2004-x64
6Hewski baba ayar.rar
windows11-ltsc_2024-x64
1Hewski bab...ER.dll
windows10-2004-x64
1Hewski bab...ER.dll
windows11-ltsc_2024-x64
1Hewski bab...1).dll
windows10-2004-x64
1Hewski bab...1).dll
windows11-ltsc_2024-x64
1Hewski bab...GU.txt
windows10-2004-x64
1Hewski bab...GU.txt
windows11-ltsc_2024-x64
1Hewski bab...1).txt
windows10-2004-x64
1Hewski bab...1).txt
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Hewski baba ayar.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hewski baba ayar.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Hewski baba ayar/AMPER.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Hewski baba ayar/AMPER.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Hewski baba ayar/LW (1).dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Hewski baba ayar/LW (1).dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Hewski baba ayar/VURGU.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Hewski baba ayar/VURGU.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Hewski baba ayar/vurgu (1).txt
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Hewski baba ayar/vurgu (1).txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Hewski baba ayar.rar
- Size 3.1MB
- Sample260922-s87mjswwcs
- SHA256 34803a9d1bf35c2808cee0dd4b3300273c7e0f51afb6b693cb6baa37b4fb69e1
- MD5 98a5b2ec4ff6758c94106aa638b1f758
- SHA1 831ab01cd91aa3df0ee0b7e524d7388281f3ba6c
- SHA512 2ef0331c8ba9949c3cda0e6871e6332025232cc076d9383953675b43b6e923a828b3f6f9e026476d29b4a25fa93eb84d708b0e48cfde92a2c25efdc9d30fc809
- SSDEEP 49152:n3Ws6HsaJ5hFXj7eh0qsDbxUOnqkTLu4MoHBGVO0zQ5+ohowdoj2x7:mtHse5DT7ntXxpqkTL/naQVRZR
- TLSH T183E533F62579244BBF2A8CE0278D57B0289D957AE6FA78EDD052C76830104493FDCC7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Hewski baba ayar/AMPER.dll unpack001/Hewski baba ayar/LW (1).dll
File Explorer
-
Hewski baba ayar.rar.rar 3.1MB
-
Hewski baba ayar/AMPER.dll.dll 2.8MB
-
Hewski baba ayar/LW (1).dll.dll 823KB
-
Hewski baba ayar/VURGU.txt422B
-
Hewski baba ayar/vurgu (1).txt1KB
Hewski baba ayar/AMPER.dll
- IMPHASH 1e35398d64a17b0cb444249f68313d4b
- SHA256 7514344506c9e1c7831ab34a9d6df214626ef767c102a9ac575e50088b58fce9
- MD5 2841d7c826d6479c7f9159ce56b73fd6
- SHA1 c94a6303475ebb70db34fc7f7e5bfefd4b71dc0b
- SHA512 0977bcd6de0fd7eddde6e9d737800173947fd9cb72fbb662d9759f1d042c4cccd04bb660848cacfb91f1a6497697900d91e4375852f4bf2f3ad86aa5cf30f123
- SSDEEP 49152:BT/5oAo1uTpnqo8AVBUxXNkyq9uGX7wT1v9AMan70ce65f71mx/thH:BTRDoUh8ALUxXNkNuuEbAzn70cFG/t1
- TLSH T1AFD52346F6D408B9D6B78138C5739906F771788907608BDF23984A292F73FE16A3B712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
okeymus3.
Minor OS version
0
Major OS version
6
Entry point
159864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Tunca\Desktop\wdl-ol-Anob\IPlugExamples\AMPER\build-win\vst2\x64\bin\AMPER.pdb
comctl32
InitCommonControlsEx
wininet
InternetGetConnectedState
kernel32
SetStdHandle
GetStringTypeW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
LCMapStringW
CreateFileW
GetTimeFormatW
GetDateFormatW
GetConsoleCP
WriteFile
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
GetStdHandle
HeapAlloc
HeapFree
HeapReAlloc
GetModuleFileNameW
GetModuleHandleExW
QueryPerformanceFrequency
ReadFile
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
FlushFileBuffers
HeapSize
SetEndOfFile
WriteConsoleW
ExitProcess
LoadResource
LockResource
FindResourceA
SizeofResource
MultiByteToWideChar
GlobalUnlock
WideCharToMultiByte
GetCurrentProcessId
GlobalLock
CompareStringW
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsGetValue
TlsAlloc
EncodePointer
SetLastError
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
user32
DefWindowProcA
DrawTextA
DrawTextW
GetWindowThreadProcessId
GetKeyState
GetWindowRect
LoadCursorA
DestroyWindow
SetWindowPos
ScreenToClient
CreatePopupMenu
GetClassNameA
TrackPopupMenu
OpenClipboard
GetCapture
SetTimer
ClientToScreen
CloseClipboard
CallWindowProcA
GetWindowLongA
ValidateRect
TrackMouseEvent
SetWindowTextA
EndPaint
RegisterClassA
EnumWindows
MessageBoxA
DestroyMenu
CreateWindowExA
SetFocus
GetUpdateRect
GetClipboardData
SendMessageA
SetCapture
AppendMenuA
PeekMessageA
IsClipboardFormatAvailable
GetWindowLongPtrA
UnregisterClassA
GetParent
SetWindowLongPtrA
UpdateWindow
ReleaseCapture
ShowCursor
InvalidateRect
GetAncestor
SetCursorPos
GetCursorPos
BeginPaint
gdi32
GetClipRgn
CreateRectRgn
SelectClipRgn
GetTextMetricsA
IntersectClipRect
SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
DeleteObject
BitBlt
GetStockObject
SetTextColor
SetBkMode
SetBkColor
CreateFontA
comdlg32
ChooseColorA
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegCloseKey
RegOpenKeyA
shell32
SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteA
VSTPluginMain
main
Name
.text
Size
288KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=260, version=26715,
count=17, id=259, version=26715,
count=174, id=261, version=26715,
count=2, id=199, version=41118,
count=39, id=261, version=26504,
count=16, id=260, version=26504,
count=10, id=259, version=26504,
count=175, id=1, productName=Unmarked objects,
count=17, id=257, version=26715,
count=33, id=265, version=27905,
count=1, id=256, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=255, productName=VS2019 v16.2.3 build 27905, version=27905,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.2.3 build 27905, version=27905,
Hewski baba ayar/LW (1).dll
- IMPHASH 50457982bf28a82cab97aa206a3f6f22
- SHA256 6c734f81e0c8e727bd6384c1218e6ebd8061440c3e3b9b6db545cb12ad12cb90
- MD5 944e0bc26f124b4536aca8717ffd6fc1
- SHA1 8d2b3ba2bcbc0856c15e2e4445b0d970dab4f5df
- SHA512 253cca3bb826461b5c721276ad08fce2114aa73e2c58498fe10356a2c596eef2dd28e345e5d27b9a8c4093478cff5557a40abf053c1330dce8afae745726ba7d
- SSDEEP 24576:l5kTwPzY2PhthHvsNm/Sr/+CglG8lDTrk:DkT6HZPsmyx8J
- TLSH T18605E04AF67548B6C426803DCE539E4AE3B2F859072197CB13A0875E7F637E1583B362
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
okeymus3.
Minor OS version
2
Major OS version
5
Entry point
116252
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
SizeofResource
GetVersionExW
GlobalUnlock
GlobalFree
LockResource
SetEndOfFile
CreateFileW
InitializeCriticalSection
CreateFileA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
HeapReAlloc
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GlobalLock
GetLocaleInfoA
GetLocaleInfoW
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
IsValidCodePage
GetOEMCP
GetACP
CloseHandle
SetFilePointer
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GlobalSize
LoadResource
FindResourceA
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
Sleep
GetTickCount
ReadFile
LeaveCriticalSection
EnterCriticalSection
RtlUnwindEx
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
GetProcAddress
GetModuleHandleW
HeapDestroy
HeapCreate
HeapSetInformation
RtlPcToFileHeader
RaiseException
FlsAlloc
SetLastError
FlsFree
FlsGetValue
DecodePointer
EncodePointer
GetModuleFileNameA
GetStdHandle
WriteFile
GetCommandLineA
FlsSetValue
GetCurrentThreadId
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree
GetLastError
GetProcessHeap
user32
GetDoubleClickTime
SetFocus
GetWindowLongPtrW
GetWindowRect
DestroyWindow
DefWindowProcW
MapWindowPoints
GetSystemMetrics
RegisterClassW
ReleaseCapture
GetCursor
GetCursorPos
SetWindowPos
GetClassNameW
GetWindowLongW
InvalidateRect
GetAsyncKeyState
wsprintfW
BeginPaint
LoadCursorW
TrackMouseEvent
GetParent
GetFocus
GetKeyState
UnregisterClassW
SetCapture
GetUpdateRgn
SetCursor
EndPaint
CreateWindowExW
MessageBoxW
PeekMessageW
DispatchMessageW
GetDC
SetWindowLongPtrW
gdi32
SetBkColor
CreateRectRgn
CreateSolidBrush
DeleteObject
SetTextColor
shell32
DragQueryFileW
SHGetFolderPathW
ole32
RevokeDragDrop
CoCreateInstance
RegisterDragDrop
OleUninitialize
OleInitialize
shlwapi
PathFileExistsW
gdiplus
GdipGetImageHeight
GdipSetImageAttributesColorMatrix
GdipCreateBitmapFromStreamICM
GdipDrawImageRectRectI
GdipDeletePen
GdipFree
GdipDeleteBrush
GdiplusShutdown
GdipMeasureString
GdipSetTextRenderingHint
GdipGetImagePixelFormat
GdipGetFontHeightGivenDPI
GdipDeleteFont
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipGetDpiY
GdipSetClipRectI
GdipGetImageGraphicsContext
GdipSetSmoothingMode
GdipDeleteFontFamily
GdipCreateSolidFill
GdiplusStartup
GdipCreatePen1
GdipSetPixelOffsetMode
GdipGetImageWidth
GdipSetPenDashStyle
GdipDrawLineI
GdipCloneImage
GdipCreateBitmapFromResource
GdipSetInterpolationMode
GdipSetSolidFillColor
GdipCreateFromHDC
GdipCreateFontFamilyFromName
GdipFillRectangle
GdipDrawString
GdipDrawRectangle
GdipCreateImageAttributes
GdipGetGenericFontFamilySansSerif
GdipCreateBitmapFromHBITMAP
GdipSetPageUnit
GdipCreateFont
GdipSetPenWidth
GdipDisposeImageAttributes
GdipAlloc
GdipCloneBrush
GdipSetPenColor
GdipDisposeImage
VSTPluginMain
main
Name
.text
Size
214KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
499KB
Virtual Size
498KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=56, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=160, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=222, id=1, productName=Unmarked objects,
count=22, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Hewski baba ayar/VURGU.txt
- SHA256 11aa797226e04f6a5722c35d17e159070226ce65de85f14f0a44f4403414a17c
- MD5 924e5eca609696a207e2ae0f5526c795
- SHA1 3e77209bd713f057f7fc17683ac73f6ef9046e8e
- SHA512 1ecd4706d24a4200aa0c98e0d285a8d11627a27e432f2efef06a2af2e4c0d3f48681dc5a0ac19906e3e77c1c421544df739e0dddcc811706e58277b2f5fd9786
- TLSH T104E02B54479C498D3F8DE5CCF40406E52D7A6BCBB5730FB8A55EE195971E024C1B6C02
- MD5 SHA1 SHA512 TLSH
Hewski baba ayar/vurgu (1).txt
- SHA256 41d9924d8e8fc7b7ed3fd07f4905375ed8408cb8df850172996191aa9f39771c
- MD5 d399b34028bc076109d36358a1089286
- SHA1 93e275701fb4eb0a02a917bbca1a79c8280906f3
- SHA512 d323fcb558e2dc99c7c111e75e20ea2637029a3e6d9c1dc54213bc9a826772e30bc5715a11b55b4af5f1f955cca3a6e5b5de84f184997ad3691bca3aeb3a260c
- TLSH T135215A25D95F018C2CDC929D38AD4BAAE1537E6B77B18458143CC592A88FA331136C71
- MD5 SHA1 SHA512 TLSH