file_511b14daa38842edb857a13495f2586b_2026-10-02_10_30_53_336000[.]zip

resource
unpack001/entry_1_0/BIN.eXE

file_511b14daa38842edb857a13495f2586b_2026-10-02_10_30_53_336000.zip

SHA256 3981ea9b2d2daaf86a94d02cc08b4469b3d0a9d336c41b42e32a78e4ffc9c518
MD5 6115f9c1bfaf0006c0193a27e65c13e5
SHA1 69b85bca8126e9b9b354b25153c45b558cf8b59c
SHA512 d250f3725b982a5a513700897eba012506b0ce7cd94c0c60292579cadc8fd8671fd35a3f7e38d984024cf93f91ee1b6de001253e839d21c00a9f7c0e7cf87a25
SSDEEP 12288:91bLZRgqCYGzvVzEuwIswwwjwy9/gg+luVf:zbLZRghYGBzEcswIW/gKf
TLSH
T1089423309716FDF5B840AD3CB7D47E341022A6C1A61EA15A4CBEC5135EE2ADDCD7026D
MD5 SHA1 SHA512 SSDEEP TLSH

entry_1_0/BIN.eXE

IMPHASH 5622078948c59e431d6e8cbb770f0ac7
SHA256 0c398b979558794dd9838e51b9844fa7da1eecacb222ef2c4133bc338fa221bc
MD5 328a363fc794b1790b4abc4f38757fa1
SHA1 bf24b3ca67cd29e8445c30a69ad16517a00cd44d
SHA512 86f5fdfea386a004c468fef840a766187e477ae03d94a1993435822687b05f7db7b6eb184ea0ac6f66630f77476abd25babbb038cf6d394be692366d7ebf5abc
SSDEEP 12288:AlMKL1SyqQet/7QGDVU+qAJctpGMtHkEsZn957lUFPuplhu3:nc11QdibvtEEw5yFCC3
TLSH
T12C25CF12E3C11EF5F5259C7A8D810410AA6FF802CBF4A6EB555C85362EE1A981FFC793
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

77552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aworitix.pdb

kernel32

CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetActiveProcessorCount GetActiveProcessorGroupCount GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLogicalDriveStringsW GetMaximumProcessorCount GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDefaultLangID GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemWindowsDirectoryW GetTempPathW GetThreadId GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

user32

GetCaretBlinkTime GetSysColor GetSystemMetrics

ntdll

NtReadFile NtWriteFile

Name

.text

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

513KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

241B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

manifest.json

SHA256 27079eed7a3854060ec73e5661336c5eea5320774d09a49275800b67baf4f5b7
MD5 7df1ba45d23d41f9a4a6c410764908b9
SHA1 692cb7677c57f5fe4d70cd0f18c0833c24f1164b
SHA512 fdb85a86b651cf0daba99d41e09ce8ded0b3b8696ea33608cb916dd7cf7aa9a14c65868cdd4bb14c32c84404804a2c557e00144867005693d4768052dbfb9018
TLSH
T11FE022ACF1129E2BA6D4B2E82802C493BAA050D82AEA9B251AC91928D1D4D2C4422421
MD5 SHA1 SHA512 TLSH

script_output.txt

SHA256 27079eed7a3854060ec73e5661336c5eea5320774d09a49275800b67baf4f5b7
MD5 7df1ba45d23d41f9a4a6c410764908b9
SHA1 692cb7677c57f5fe4d70cd0f18c0833c24f1164b
SHA512 fdb85a86b651cf0daba99d41e09ce8ded0b3b8696ea33608cb916dd7cf7aa9a14c65868cdd4bb14c32c84404804a2c557e00144867005693d4768052dbfb9018
TLSH
T11FE022ACF1129E2BA6D4B2E82802C493BAA050D82AEA9B251AC91928D1D4D2C4422421
MD5 SHA1 SHA512 TLSH

stdout.txt

SHA256 7b04f1269799830415bfca9aeb4970c52a85fe89238afc8490cc39766c14ffbd
MD5 938d08f430be2a48af8dcfacca82c909
SHA1 de141a5b1426d14541e0e2a170a309822c46c4b3
SHA512 6b0829032a042e632e5c1c639781ebdcc708a101ea474cab7307c5742242695813f08493f54bad29e15b49ac3a2422648528c045f0c35ce991754197e5ad604e
TLSH
T14401DC340DB25768DB4244D806ACD26AD7D1D518A1DDC298F9EC82CDDE40FAEC3F8918
MD5 SHA1 SHA512 TLSH

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer