Virus.rar
- SHA256 e3b9e29d57ae44f594c1aee1615e3865bd935a9fb39f22c20559f26f0588d5f4
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Virus.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Virus.rar
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
Virus.rar
Resource
win11-20260911-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target Virus.rar
- Size 7.5MB
- Sample261001-1k7xeabe96
- SHA256 e3b9e29d57ae44f594c1aee1615e3865bd935a9fb39f22c20559f26f0588d5f4
- MD5 e2b06ec57abb731d86094a02c541485d
- SHA1 789c3b0fff2f920b79b671903bbc0c2921ea8488
- SHA512 3d3b786e046c6d09fafa4bbf9a8183965b92950e0b654c797baee56ca3af2e0db3b507602b46c7f9c4ef839816ab81ac45fce6c21b0afb57567cc445a67a7f37
- SSDEEP 196608:b6qswIhLE75PE/RMIfdegYWr6z/ZYRF7I3IECQrXbln:b6DhEdPE71eEr6zxYn7IYECQrXbp
- TLSH T19C8633533EA63AE4FC904F369B253F39EFF21250EC6171648184C6BD9EF948906F5262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/Virus/Virus-SCARS.exe ConfuserEx static1/unpack001/Virus/hacker-ᏕCAᏒᏕ.exe ConfuserEx - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Virus/M4R7H-virus.exe unpack001/Virus/Virus-SCARS.exe unpack001/Virus/hacker-ᏕCAᏒᏕ.exe unpack001/x . X . x.exe
File Explorer
-
Virus.rar.rar 7.5MB
-
Virus/M4R7H-virus.exe.exe 4.8MB
-
Virus/Virus-SCARS.exe.exe 6.1MB
-
Virus/hacker-ᏕCAᏒᏕ.exe.exe 1.1MB
-
x . X . x.exe.exe 63KB
Virus/M4R7H-virus.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c9588b1b3a568075a16538bf7abb75fbbcc15ef88e571e9817595236f895bc85
- MD5 28348c6862de24dc3813c96c5dd42cde
- SHA1 f411c5c23268f4296c7c6ff1ca08d91d76a8b1e0
- SHA512 06105a4ae536b2ec024eedfbb365030bc1a8c89d3aaee9532523b5aa8cf604f4e4635e0bcf3b08454ff1321fe79f2df49e9bed686fb2f74eca822f0a0f0840f3
- SSDEEP 49152:pD+EHgKdgBnb8D/FFhR9b6rJpVQ3u+IT:pD+MdgBb8D/PhR9eHVQ3u+IT
- TLSH T1DD36FE4CD088B76BA100B9301EA62D5713C5674864FDA91D8A37FBF22D274FDF9278A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5066254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Virus/Virus-SCARS.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4d829030cd30dd5f64fe67bbb2088b7540c148d480f256f84eca1aed58988d47
- MD5 0843b3dad4d3a584685e4b0ff8d0a58d
- SHA1 5ce4f8bee1791dff73edb4692c10cc72e242f728
- SHA512 fbb03c517b4c70074c4a1bfcd5ccced4e1de286d371fb6c8984b40fdd6aac6628b6164e42677591528caafa0427faf5cd6a12dabaa9dbcaaeb7aefad6fa6b321
- SSDEEP 98304:pBuDNFbhHsaA3wUvCPgHsbj/vjhrBcf1w+Zc/S2rTIZLJq8W3SAyR:pINXHEw+sbfgfnZc/53
- TLSH T1B256E04D9089B75BE100B9300EAA2D5623C55F5478FEA41D8A33BAF22D374FDF9274A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6211358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
136KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Virus/hacker-ᏕCAᏒᏕ.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 96de6c0f63e90539cf11fe8e3942eab1fec014afe76c24a3528095f7859db5cf
- MD5 481d2040fa743cbb5b54aa9c5b0db718
- SHA1 eb304cfdba8bea13ea6d69c98962ee7343ea942f
- SHA512 5089cde303ed5396e24ddf4e4b13ca1040626513af3f8727fc30559908a4210d2647cf828e43affe3fa4dcb8084219ce33576cbfe955e0ccdc2449dab67f02fe
- SSDEEP 12288:BMVBUqsUPwCbwDd63LOR4vxUl0yjZ3tJnmS/AVeXR6F5kQYBzJRZ0qlhB:GB3qIVib3JBoK6Dq0IB
- TLSH T12535528C9088B75BD100B9300EAA3D5613C59F4464FEA41D9A33BAF22D374F9FD2B5A5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
971726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
941KB
Virtual Size
940KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
139KB
Virtual Size
139KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
x . X . x.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f32c9e7e7178951592b35a60e9d76f8db3ff9dc5fa55d233d7ffe5ffecf30196
- MD5 903f00d6b06c5583aad23794133faa64
- SHA1 57d6a45de28e68f0e7fd0aecc750865d6972e202
- SHA512 3264c81265a53a3090b0e17e133e7f0941c9c42f7a318af27451053a4d03536e3dc963034a15fa317bfaae0fba307670a49435838143b9071372f1c42a42a7a6
- SSDEEP 768:o4Bo8HxviTEhzkMBKRQZ34S3aoWP+aWnW790aUhlV/nLkYtYcFwVc6K:ZBbH1iYhMQZ340aoQ790aSzk0wVcl
- TLSH T1DE53AD4C8188775BE100B9300EAA2D5213D5A74464FDA82D9A37F6F22E370FDFA775A4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
63166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
54KB
Virtual Size
53KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ