9040f827f0cf432d576686b052d05fb8394cd8e4b800bee3080ff63efdac74bc
- SHA256 9040f827f0cf432d576686b052d05fb8394cd8e4b800bee3080ff63efdac74bc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Postal Plus.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Postal Plus.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 9040f827f0cf432d576686b052d05fb8394cd8e4b800bee3080ff63efdac74bc
- Size 524KB
- Sample260930-2j72fs11az
- SHA256 9040f827f0cf432d576686b052d05fb8394cd8e4b800bee3080ff63efdac74bc
- MD5 d5468816fe5cf4c641c71d3166d8f735
- SHA1 6dcf2a17dc88c808fbb2645a7d1fd3af80243fe6
- SHA512 6d16335afe1cff4bf334ea1344d81610b3a04533692a66a868314e3446d24855d64cf8ec758ca501e83380b3802372bd805da7c0440db3e58693b8aa1239472a
- SSDEEP 12288:Iyccdjjoz6Tfw7BbAodZypgl6CeZhRlm712nMA/AYMbcPScZHOqBgarTwNUd+w5l:VoOLUBPPTgCehRe1S/FacqclOMgaoNZ+
- TLSH T17CB42356D27DA5EEE84A34240F6E1096B26F207A44C3017591ECE5A1F3CB33FB9A3356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Postal Plus.exe
File Explorer
-
9040f827f0cf432d576686b052d05fb8394cd8e4b800bee3080ff63efdac74bc.zip 524KB
-
Postal Plus.exe.exe 1.3MB
-
res/levels/postal plus realms.ini25KB
Postal Plus.exe
- IMPHASH bcc4b034ad73a5708de7aabe43789d98
- SHA256 1e084c5734aca49694b898b78106aa07c28fa9b0837a2408ac53f6e130ca880c
- MD5 f9b3d7932b0da556701ec849f4f09aa4
- SHA1 8d608c9dd3a7d94b933bf2c242977bf44aa6dd95
- SHA512 6dcad208e11ee51fc32eae28457cd2a4a570357294d2128b944b1c2aad45ae1e6525f885b1429a4870f67bea1cbfa9a22b4eb91e5e8b821febcf1fdd5102c896
- SSDEEP 24576:PakkViCAeqOTY/3sBky0vHcR6mM3uaFFgHkiTcW:V+xqEs3sBky0v8R03uasHkqcW
- TLSH T172556A54B6035578D44A003D9F9F3FA6322F5722037862D7A3E9146D89A4ED22EFE31B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
730631
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
sdl2
SDL_GameControllerClose
SDL_GameControllerGetButton
SDL_GameControllerGetAxis
SDL_GameControllerUpdate
SDL_GameControllerEventState
SDL_GameControllerGetAttached
SDL_GameControllerOpen
SDL_IsGameController
SDL_JoystickEventState
SDL_NumJoysticks
SDL_memcpy
SDL_Init
SDL_PollEvent
SDL_Quit
SDL_Delay
SDL_DestroyRenderer
SDL_RenderPresent
SDL_RenderCopy
SDL_RenderClear
SDL_SetRenderDrawColor
SDL_RenderSetLogicalSize
SDL_UpdateTexture
SDL_CreateTexture
SDL_CreateRenderer
SDL_GetRenderDriverInfo
SDL_GetNumRenderDrivers
SDL_ShowSimpleMessageBox
SDL_SetHint
SDL_DestroyWindow
SDL_GetWindowSize
SDL_SetWindowTitle
SDL_CreateWindow
SDL_GetDesktopDisplayMode
SDL_GetError
SDL_snprintf
SDL_sscanf
SDL_strcmp
SDL_strdup
SDL_free
SDL_GetModState
SDL_GetKeyboardState
SDL_GetWindowGrab
SDL_SetWindowGrab
SDL_SetWindowFullscreen
SDL_GetWindowFlags
SDL_GetTicks
SDL_ShowCursor
SDL_WarpMouseInWindow
SDL_GetMouseState
SDL_ShowMessageBox
SDL_vsnprintf
SDL_memset
SDL_WasInit
SDL_QuitSubSystem
SDL_CloseAudio
SDL_UnlockAudio
SDL_LockAudio
SDL_PauseAudio
SDL_OpenAudio
SDL_SetMainReady
SDL_isspace
SDL_wcslen
SDL_iconv_string
SDL_malloc
SDL_GetCurrentDisplayMode
steam_api
SteamRemoteStorage
SteamAPI_RunCallbacks
SteamAPI_RegisterCallback
SteamUtils
SteamAPI_Init
SteamUserStats
kernel32
DecodePointer
GetFileAttributesExW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetCommandLineW
GetFullPathNameA
SetEnvironmentVariableA
SetEndOfFile
WriteConsoleW
CreateFileW
SetFileTime
CloseHandle
CreateFileA
GetModuleFileNameA
GetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
OutputDebugStringW
SetStdHandle
FlushFileBuffers
SetFilePointerEx
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
DeleteFileW
GetConsoleCP
ReadConsoleW
GetConsoleMode
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
FindClose
GetTimeZoneInformation
GetOEMCP
GetACP
IsValidCodePage
GetModuleFileNameW
WriteFile
GetStdHandle
GetCurrentThreadId
GetProcessHeap
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
ReadFile
HeapReAlloc
AreFileApisANSI
GetModuleHandleExW
ExitProcess
RaiseException
GetCommandLineA
GetSystemTimeAsFileTime
HeapAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
RtlUnwind
HeapFree
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
GetTempPathA
GetTempFileNameA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
CreateDirectoryW
MultiByteToWideChar
GetStringTypeW
wsock32
ntohs
listen
ioctlsocket
htons
htonl
inet_ntoa
connect
closesocket
bind
accept
WSACancelBlockingCall
WSASetBlockingHook
WSAUnhookBlockingHook
WSAGetLastError
WSACleanup
recvfrom
select
send
sendto
setsockopt
socket
gethostbyname
WSAStartup
recv
Name
.text
Size
939KB
Virtual Size
938KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
179KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
89KB
Virtual Size
830KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=199, version=41118,
count=55, id=223, productName=VS2013 build 21005, version=21005,
count=76, id=225, productName=VS2013 build 21005, version=21005,
count=245, id=224, productName=VS2013 build 21005, version=21005,
count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=201, id=1, productName=Unmarked objects,
count=151, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
res/levels/postal plus realms.ini
- SHA256 79e2825cdcb3793f78caf5e572209e3c0fabf32d716e5398cafc3c2436f80eb8
- MD5 d7c820c1a65ce6d9656db5fabd004b2e
- SHA1 34637ef924e7b01929e8723f8f35a068b0d1997e
- SHA512 1594209bbaa7eaf4066ed7482088baf720b453c3dacb03d5cd602bb2e9ab89a7525ec6463b93e4504ede3a04294572484dcb4d61a7db09f92cfc015e1176a235
- SSDEEP 384:I/SAf67U5Rsj9S6E4BwotF4irplTqe4GAdhOe:hAfQU5RLotNrpluJ
- TLSH T131C2F13BF55DF7B2CC6992A9E15C6893FB715D00C7007298E8C4B2209E16C7EB5AC8C8
- MD5 SHA1 SHA512 SSDEEP TLSH