cihuy.rar
- SHA256 b94861189472ae6c979758ed363bbab834fa2932b387943c67d82373ebd22371
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cihuy/Book1.xls
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral2
Sample
cihuy/Copy of Rundown Pengundian BRI Sidoarjo FIX 2.xlsx
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral3
Sample
cihuy/DAFTAR IWABRI.docx
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral4
Sample
cihuy/Getting Started with OneNote.exe
Resource
win11-20260911-en
windows11-21h2-x64
23 signatures
600 seconds
General
- Target cihuy.rar
- Size 478KB
- Sample260930-npvrestgkf
- SHA256 b94861189472ae6c979758ed363bbab834fa2932b387943c67d82373ebd22371
- MD5 7293a7167fc0a3fc3d877f50d338fcef
- SHA1 19f2177b096411247a5ec9dc9d60c7c119a4332f
- SHA512 076a38a3b6eda662f5254d0739b02eebc1c5727eaed2c5fb5b97e845a4b32c82ab96acd8e67987e0370bedd7863370b559cd4977b29c7b1d04302a7c501129bd
- SSDEEP 12288:/pDJkeudIrFQTNr8GrZnU4gxbf5FEUshsLb1:/1JbuyZQhrNZnr4zfsSl
- TLSH T13CA4238308AC4F9420AD589BBE7296236ED1464449F71717B1F61E4D3F8B2DF193A43B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cihuy/Getting Started with OneNote.exe
File Explorer
-
cihuy.rar.rar 478KB
-
cihuy/Book1.xls.xls 20KB
-
cihuy/Copy of Rundown Pengundian BRI Sidoarjo FIX 2.xlsx.xlsx 29KB
-
cihuy/DAFTAR IWABRI.docx.docx 9KB
-
cihuy/Getting Started with OneNote.exe.exe 588KB
cihuy/Book1.xls
- SHA256 4bd9be184d90d1fdfa8dd6ed067d3b7912d9cb19f1f5066f2900fda33d1fe6b3
- MD5 398d57893ade157448837ccf93c28a1e
- SHA1 190e8bb6501a8700feec3f661a3c2cd4c2c397cc
- SHA512 571a17df63ac7934f8d06ce02fd394200565177700571fa39007759792d20bc04ad67aa939b7454c03a28cb2b1231a464f9fe682b8077cec4385110834b30137
- SSDEEP 384:tuI2ErjWZ+RwPONXLkRyoDhIcp0fDlaGGxTqcLrK6zrApsUlUmrUlfldG:tuqvWZ+RwPONXoRjDhIcp0fDlaGGx+c1
- TLSH T10C92EEE3B6E59C45CE55033A49A783A06723FC515BA7838B3388F7262FB1ED09943617
- MD5 SHA1 SHA512 SSDEEP TLSH
cihuy/Copy of Rundown Pengundian BRI Sidoarjo FIX 2.xlsx
- SHA256 1e5f4a52330a6ae3b53e57695296244af4a1deb8ea5db602e2df5bf8dea5ff33
- MD5 bf5edc0a21bcc7492ebe4c41a1576b3d
- SHA1 2add319e1d669bf40269e64c6df1a34c6e907413
- SHA512 54c5ed5616c06db3c0bd6d6d9d8aa586c84f0cd888f2964fcc86c6e0aff1f2effaffc615eb499688be090c777e1246676dfeb0c71453d6f2520d0f09d14e56d9
- SSDEEP 768:C1k14X1Cb1+1U10o+05SKyfK+IUEW6OOOOOOOOSN1mj1Y+RFrCGPdM3OOOOOOOO1:C1k1K1Cb1+1U10o+05SKyi1W6OOOOOOA
- TLSH T157D2CF97E0AC599FFBBCD838C040474453B967664336D91B8B15BA4F2CF6AF92E0150A
- MD5 SHA1 SHA512 SSDEEP TLSH
cihuy/DAFTAR IWABRI.docx
- SHA256 a508bbc738eb7b74756fe7ea2a7f020eaa0dc3ca8a38e0c45b86dfd23f0e7871
- MD5 72fc667832e9dc018923a7003aef362e
- SHA1 168b185c1d4d837a348d1819c0c9662b737f867a
- SHA512 f53e3ae3bc7d8498a479684874c19dea80b2b223bf6796457b8d4baef24ac795474290b073640e30f752fa14b565569cb1b8c61ba7c127570c68ef536495fb04
- SSDEEP 192:a56NQP8OdfJYqCnTrNScnuLS61iDXzkJJ:aANQEOdfJYqMTXnuuwi/kJJ
- TLSH T118124AF7C261147CC72A55F1948A2949D737B94B9F3A3E0B3B61C90984FA4CE6E11249
- MD5 SHA1 SHA512 SSDEEP TLSH
cihuy/Getting Started with OneNote.exe
- IMPHASH a9042500c45caf1e96695e809a07a5db
- SHA256 ca06b143ef906fd71901cfa9b798e0bff22d530dbe265b2ac1bf54d06e511545
- MD5 65f0c8aa051a729c12e3dd9d9a324199
- SHA1 52ce17f0369920e554d7a526321c2adc43724ef0
- SHA512 13ddfd5c5f525a4ae7d5c8aa40d01f1b929f28fdd75f4d7d28040046d04db39fed4717407461d3a7759063d98f0ebf14228d38277597b53be640c8c876de1319
- SSDEEP 12288:BpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqs2Etr6C++GY:BpUNr6YkVRFkgbeqeo68Fhqotr6X+P
- TLSH T1DAD4C002A74EC964DD2A11F4D85FC3E59C6B2F62CDD6C1DB26B1FEC778706A0B00981A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LoadLibraryA
Sleep
CloseHandle
FreeLibrary
GetTempPathA
GetFileAttributesA
GetComputerNameA
GetCurrentDirectoryA
GetModuleFileNameA
SetErrorMode
WriteFile
GetTickCount
CreateFileA
GetLastError
CreateMutexA
OpenMutexA
VirtualProtect
GetLocaleInfoA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
TerminateProcess
GetCurrentProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
HeapSize
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetSystemInfo
shell32
ShellExecuteA
Name
.text
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
392KB
Virtual Size
390KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
148KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=105, version=2067,
count=41, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=12, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=3, id=93, version=2179,
count=61, id=1, productName=Unmarked objects,
count=3, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,