imabadboy-main.zip
- SHA256 d1ddb702b866b83ffdf9869a9a741a6f5285808914ee218d7fbf46b25a67cebe
Overview
overview
3Static
static
3imabadboy-main.zip
windows10-2004-x64
1imabadboy-main.zip
windows11-ltsc_2024-x64
1imabadboy-...er.exe
windows10-2004-x64
1imabadboy-...er.exe
windows11-ltsc_2024-x64
1imabadboy-...DME.md
windows10-2004-x64
3imabadboy-...DME.md
windows11-ltsc_2024-x64
3imabadboy-...gn.exe
windows10-2004-x64
1imabadboy-...gn.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
imabadboy-main.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
imabadboy-main.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
imabadboy-main/Decompiler.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
imabadboy-main/Decompiler.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
imabadboy-main/README.md
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
imabadboy-main/README.md
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
imabadboy-main/erto3e4rortoergn.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
imabadboy-main/erto3e4rortoergn.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target imabadboy-main.zip
- Size 5.5MB
- Sample260930-zxmlkaab96
- SHA256 d1ddb702b866b83ffdf9869a9a741a6f5285808914ee218d7fbf46b25a67cebe
- MD5 7df20de932c7eea3a22cc394597e4df3
- SHA1 3e201982a4a877087e87e68d4e74319d7f749afa
- SHA512 fd0b11854079db3d89e052207de86fc04d8f93cd985a30b2c1984a5a0e2abdf73dad74bc9124f6871b6f666801f1748a35d1b8fd5413e861c41f511e384e1b76
- SSDEEP 98304:WpsWsSCJrczq5gHAF6XRovpIrOXug5/9AaJ1p3fdF9ZkCqQl382stMN:Wh2JrBgSARovpd+g5SK4CAMN
- TLSH T18846332EB7E55326FC944FDF7166CD415E030AAEE9E21B67EE71083B49A0DF0666D002
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/imabadboy-main/Decompiler.exe unpack001/imabadboy-main/erto3e4rortoergn.exe
File Explorer
-
imabadboy-main.zip.zip 5.5MB
-
imabadboy-main/Decompiler.exe.exe 9.4MB
-
imabadboy-main/README.md5KB
-
imabadboy-main/erto3e4rortoergn.exe.exe 3.7MB
imabadboy-main/Decompiler.exe
- IMPHASH 8d1d7934b800e4ac91064a5f9d0c910f
- SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
- MD5 a109790efbe0542dddf63ef0415dd508
- SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
- SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
- SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
- TLSH T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7445708
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
decomp_server.pdb
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
kernel32
GetCurrentThreadId
SetFileCompletionNotificationModes
GetLastError
Sleep
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
InitializeSListHead
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
IsDebuggerPresent
UnhandledExceptionFilter
GetStdHandle
GetCurrentProcessId
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
PostQueuedCompletionStatus
GetProcessHeap
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
SetHandleInformation
GetFileInformationByHandleEx
GetFinalPathNameByHandleW
GetModuleHandleW
FormatMessageW
GetConsoleOutputCP
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
HeapAlloc
GetFileType
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetQueuedCompletionStatusEx
SetConsoleMode
GetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
CloseHandle
SetUnhandledExceptionFilter
GetCurrentProcess
CreateIoCompletionPort
IsProcessorFeaturePresent
ws2_32
WSAStartup
WSAGetLastError
WSACleanup
ioctlsocket
setsockopt
closesocket
WSASend
send
recv
shutdown
getsockname
accept
listen
bind
WSASocketW
WSAIoctl
ntdll
NtCancelIoFileEx
NtDeviceIoControlFile
NtWriteFile
RtlNtStatusToDosError
NtCreateFile
vcruntime140
__current_exception_context
memcpy
__current_exception
__CxxFrameHandler3
__C_specific_handler
_CxxThrowException
memcmp
memmove
memset
api-ms-win-crt-math-l1-1-0
pow
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_initterm_e
exit
_exit
__p___argc
_set_app_type
_seh_filter_exe
__p___argv
_cexit
_initialize_narrow_environment
_initterm
_configure_narrow_argv
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_get_initial_narrow_environment
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Name
.text
Size
7.1MB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
501KB
Virtual Size
501KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34321,
count=3, id=259, version=34321,
count=9, id=260, version=34321,
count=23, id=261, version=34321,
count=203, id=1, productName=Unmarked objects,
count=1152, productName=Unmarked objects (old),
count=1, id=258, version=34435,
imabadboy-main/README.md
- SHA256 ed159cc301f19b4a08ba626c12d95f0fa5deda0a8a3f2a6505bb57cd203b8d6b
- MD5 a99ab8b74607ed26b92d086c604dbc91
- SHA1 b8c7ec5e6d6ac17f5d84db377500685fcc8e7821
- SHA512 dd0b128c9096ba2aa2b11a883220588ed6b5e6132b76f70491ccf19f9b68472511115616ca523a09bf21cd1d90ae4c116929068cfc3abc892feab5d05aa32140
- SSDEEP 96:N3fanRzclr+4KL0upVmxozc2s/mEtYSjfnVt6oFWGaMnuEoJ5Mem7FtKlU:ZeQlKL0Txoi/mEtYAfnNW89
- TLSH T198C1D91BF310577447870261BE0DBEECEB2BE16C03C560EB58BCD56C53AA2A342375A8
- MD5 SHA1 SHA512 SSDEEP TLSH
imabadboy-main/erto3e4rortoergn.exe
- IMPHASH 3ea8d1f7c399cbf070a36d4f9f0fe436
- SHA256 1e7f72606b420601afc574042f51f8c5ef01701c7ea601f367de9e854635148d
- MD5 6c67d01f3726ab14561005bef8429203
- SHA1 afd1796caa8802f8fa8ce0454820b6c98685be89
- SHA512 c18199942df8c6e0492497270a182401fe8f8930b11c4e8c71e91d1568bcf50712fe94c778c36f66fc05c7c5acbb5c6937b02ec86920e0d12b71ef16bbb1fa63
- SSDEEP 49152:ItaED9imEWahwhikp14jjOwk3pv+Ny5t4z2D66EStPR0cIRn3BL/jWjWTM:IKfWiAQVipcy5tRAylq6yTM
- TLSH T14B06CF56B1A810E8D5BBD17CC6878957D6B23C4903309AFB22E4E6351F6BBE04F7E610
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3239936
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
Name
.9ebm7l8
Size
295KB
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ecoyf9z
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.on269b9
Size
5KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.krnh81g
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.9uzxho3
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.epvlkgu
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.0picjpv
Size
625KB
Virtual Size
625KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=175, id=261, version=35222,
count=18, id=260, version=35222,
count=8, id=259, version=35222,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=93, id=261, version=35721,
count=19, id=257, version=35222,
count=224, id=1, productName=Unmarked objects,
count=12, id=265, version=36260,
count=1, id=255, version=36260,
count=1, id=258, version=36260,