Archive.zip
- SHA256 174d11e4bf949a545e281e2474249e8ec0f7b031241fccedfdfdfa9d2c28b235
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Archive.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
Archive.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
encryptor.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral4
Sample
encryptor.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
300 seconds
Behavioral task
behavioral5
Sample
gui.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral6
Sample
gui.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
General
- Target Archive.zip
- Size 8.5MB
- Sample260930-xd9kwazbjd
- SHA256 174d11e4bf949a545e281e2474249e8ec0f7b031241fccedfdfdfa9d2c28b235
- MD5 5a6ae32acabeb13ad2b8941582a86421
- SHA1 8c1511d18857e908e10ff12610c1ab8d899ce4cc
- SHA512 29752549613672095b76da2a6cb449f57002383ccddb9b673efb082a451d0925c873d7f05eef6a5f615c71a0d01c908aaa29d9c8fc24c4790902f5bff0ca4ea8
- SSDEEP 196608:m94Vx/McdxU21zu+V8q88mlxRIeZTGroTygJjfV4BA+cl8osRyP:a4BRupVZs+TUzgJ54BcPsRyP
- TLSH T19E9633FE7579FE6D9991600E0A40471AF7B64F4226BF2387B727F0C31341A938299D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/encryptor.exe unpack001/gui.exe
File Explorer
-
Archive.zip.zip 8.5MB
-
__MACOSX/._encryptor.exe163B
-
__MACOSX/._gui.exe163B
-
encryptor.exe.exe 5.9MB
-
gui.exe.exe 16.7MB
__MACOSX/._encryptor.exe
- SHA256 50adbc279a77a6b42e394481def9fc8a12a831ba696ab74b8f618e4838732830
- MD5 35029d6970f010c57b5d99c080b18d7e
- SHA1 650496e0e3c1753a8268bc10b0aba920f98a5a5f
- SHA512 0d4feadc360efa1984cb2c00a06ed7e705210b36d5d8edcf011e25de8671aff08e12514043f30d6eef9fc25fcd10de151e8ace8c6dd6d2039128c2c7783d9f49
- TLSH T11FC012A469C0C2F2C41840780B833D16B3E9453491B71522710D85800700310779020B
- MD5 SHA1 SHA512 TLSH
__MACOSX/._gui.exe
- SHA256 50adbc279a77a6b42e394481def9fc8a12a831ba696ab74b8f618e4838732830
- MD5 35029d6970f010c57b5d99c080b18d7e
- SHA1 650496e0e3c1753a8268bc10b0aba920f98a5a5f
- SHA512 0d4feadc360efa1984cb2c00a06ed7e705210b36d5d8edcf011e25de8671aff08e12514043f30d6eef9fc25fcd10de151e8ace8c6dd6d2039128c2c7783d9f49
- TLSH T11FC012A469C0C2F2C41840780B833D16B3E9453491B71522710D85800700310779020B
- MD5 SHA1 SHA512 TLSH
encryptor.exe
- IMPHASH 1cb8f983e243b3418da5935546645afa
- SHA256 dfaf0e2e1c579d5a136e3b83da28d6ecfe9eec95030fe4a9918c779776f51e4e
- MD5 2da9891d978ade2f63782a080b252606
- SHA1 d55ea9133e1a13b66899a4a119996ee0cb86ce0d
- SHA512 4291a57458528d97bf4fbbca93acb41454f8af273dca169c137777205541435503bebd7db1689fd3878a6a05e4ff3ba759e4db9107e9a2baaa6c24340237da20
- SSDEEP 49152:GUmbbbCVIdGSOU0FiUX5EVG60Dd5Pnf4Imug2DVOnX6IxBjlorHFqMY50O8U6IU+:VPF/PvfkuUxBS7Ay2t+st9iOFnKJGv
- TLSH T155568E43F25254DDC21BD539C2A67637B33679892131AFBB1EC89F356E22AC48B1D318
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
bcrypt
BCryptGenRandom
kernel32
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwindEx
VirtualProtect
VirtualQuery
__C_specific_handler
CloseHandle
GetFileInformationByHandle
AddVectoredExceptionHandler
CancelIo
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreatePipe
CreateProcessW
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerExW
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DuplicateHandle
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetTempPathW
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeProcThreadAttributeList
LockFileEx
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleW
ReadFile
ReadFileEx
RemoveDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFile
UnmapViewOfFile
UpdateProcThreadAttribute
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFileEx
lstrlenW
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
log
pow
trunc
api-ms-win-crt-private-l1-1-0
memcmp
memcpy
memmove
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_fpreset
_initialize_narrow_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
fflush
setvbuf
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
ntdll
NtCreateFile
NtCreateNamedPipeFile
NtOpenFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
userenv
GetUserProfileDirectoryW
bcryptprimitives
ProcessPrng
advapi32
SystemFunction036
ws2_32
GetHostNameW
WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSARecv
WSASend
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
824KB
Virtual Size
824KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
115KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
gui.exe
- IMPHASH 9daf53922ee76eee4fc7c454a1f8cb30
- SHA256 7a2212d062681504c930c0910e74edd9e5cf35276d83b0d5833beb8a02fcc868
- MD5 69e643f5ab1ac2e5255297106bd13645
- SHA1 f0115bb34581a1130d64d512553ec1656628f17e
- SHA512 b3e8eb10ac2e5cbb76bf93fbe3d28b0681a95aec6b8de332aef4529cddbb50ff1414e7bd4ecbf35a23afacf025cdf5bef66c3209a30d58383eab906f712c998f
- SSDEEP 98304:t0a89VGyNQtr/GFUHwM154Hdw7MTsqbL1JBAG9/XF8bq++sIsiOFTXRH/bvrnkwh:x2V3/FUV154H/jb2M//+HFTXRH/bvrnp
- TLSH T1E5079E43F212499DC127D63682B6363BB23677482624AFBB1F885F355F62BC04E1B758
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
ImpersonateAnonymousToken
RevertToSelf
SystemFunction036
gdi32
ChoosePixelFormat
CreateBitmap
CreateCompatibleBitmap
CreateDIBitmap
CreateRectRgn
DeleteObject
DescribePixelFormat
GetDIBits
GetDeviceCaps
GetObjectW
SetBitmapBits
SetPixelFormat
SwapBuffers
kernel32
AddVectoredExceptionHandler
CancelIo
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreatePipe
CreateProcessW
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerExW
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
GetCommandLineW
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFullPathNameW
GetModuleHandleW
GetOverlappedResult
GetProcessHeap
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetTempPathW
GetWindowsDirectoryW
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSection
InitializeProcThreadAttributeList
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LockFileEx
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReadFileEx
RemoveDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetWaitableTimer
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFile
UnmapViewOfFile
UpdateProcThreadAttribute
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFileEx
__C_specific_handler
lstrlenW
GetTimeZoneInformationForYear
FreeLibrary
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
SetThreadErrorMode
CloseHandle
GetModuleHandleA
Sleep
GetConsoleMode
GetConsoleScreenBufferInfo
GetFinalPathNameByHandleW
GlobalFree
SetConsoleMode
SetConsoleTextAttribute
SetLastError
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
_hypot
acosf
atan2f
cbrtf
ceil
ceilf
cos
cosf
exp2f
expf
floor
floorf
fma
fmod
fmodf
log
log10
pow
powf
round
roundf
sin
sinf
tanf
trunc
truncf
api-ms-win-crt-private-l1-1-0
memcmp
memcpy
memmove
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_fpreset
_initialize_narrow_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
fflush
setvbuf
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
ntdll
NtCreateNamedPipeFile
NtCreateFile
NtOpenFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
opengl32
wglCreateContext
wglDeleteContext
wglGetCurrentContext
wglGetCurrentDC
wglGetProcAddress
wglMakeCurrent
wglShareLists
shell32
DragFinish
DragQueryFileW
shlwapi
AssocQueryStringW
user32
AdjustWindowRectEx
ChangeDisplaySettingsExW
ClientToScreen
ClipCursor
CloseClipboard
CloseTouchInputHandle
CountClipboardFormats
CreateIcon
CreateIconFromResourceEx
CreateIconIndirect
CreateWindowExW
DefWindowProcW
DestroyCursor
DestroyIcon
DestroyWindow
DispatchMessageW
EmptyClipboard
EnableMenuItem
EnumClipboardFormats
EnumDisplayMonitors
FlashWindowEx
GetActiveWindow
GetAsyncKeyState
GetClassInfoExW
GetClassNameW
GetClientRect
GetClipCursor
GetClipboardData
GetClipboardFormatNameW
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetMonitorInfoW
GetRawInputData
GetRawInputDeviceInfoW
GetSystemMenu
GetSystemMetrics
GetTouchInputInfo
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
InvalidateRgn
IsClipboardFormatAvailable
IsIconic
IsProcessDPIAware
LoadCursorW
LoadImageW
MapVirtualKeyExW
MapVirtualKeyW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MsgWaitForMultipleObjectsEx
OpenClipboard
PeekMessageW
PostMessageW
RedrawWindow
RegisterClassExW
RegisterClipboardFormatW
RegisterRawInputDevices
RegisterTouchWindow
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
ScreenToClient
SendInput
SendMessageW
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetForegroundWindow
SetMenuDefaultItem
SetWindowDisplayAffinity
SetWindowLongPtrW
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextW
ShowCursor
ShowWindow
SystemParametersInfoA
ToUnicode
ToUnicodeEx
TrackMouseEvent
TrackPopupMenu
TranslateMessage
ValidateRect
api-ms-win-core-path-l1-1-0
PathCchStripPrefix
bcrypt
BCryptGenRandom
dwmapi
DwmEnableBlurBehindWindow
DwmSetWindowAttribute
imm32
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
OleInitialize
RegisterDragDrop
RevokeDragDrop
userenv
GetUserProfileDirectoryW
uxtheme
SetWindowTheme
ws2_32
GetHostNameW
WSACleanup
WSADuplicateSocketW
WSAGetLastError
WSARecv
WSASend
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
Name
.text
Size
8.6MB
Virtual Size
8.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
187KB
Virtual Size
187KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
278KB
Virtual Size
278KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ