sample.zip
- SHA256 a81a748a88b6ba340c7aca8f39853d0978c8e79e75f45b379bc246a476c3b915
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sample.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target sample.zip
- Size 185KB
- Sample261002-vl4y9azfpg
- SHA256 a81a748a88b6ba340c7aca8f39853d0978c8e79e75f45b379bc246a476c3b915
- MD5 b11d071092cbe5dd8f1a21aa0243f342
- SHA1 eb6bef66b7104bfec31f7ec0d45b56f239c00851
- SHA512 fdfa1b8f341ea3b31369df6083c6826aa592211d82f5a1d31bff4794c8ebe2a29cf42bc32ef997e2452e3bce3a4c15027c45165fb76ee34f11bd6341481c0164
- SSDEEP 3072:aEdJSnLop1mUD4dbmtvqILlz2lIWOTbp1S3v/oJvS94qQ:aCcJUD4FmtrBl7Sf/cpqQ
- TLSH T10F04135325BA1F0DCAC9F591913EBB3DAC4B4C871483BACE899EA312E47794109C2D3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/sample.bin
File Explorer
-
sample.zip.zip 185KB
-
ServiceLog.txt101KB
-
sample.bin.dll 157KB
ServiceLog.txt
- SHA256 9f27721c56db2688f66254673ec9d88ae2fd89d392dc47dded3d91fcdecce5fc
- MD5 fee09930c436ae8a4f63e3f294db8340
- SHA1 ffb473c5b1981eff8acbfd0b7e892cfede4caf52
- SHA512 ca3c10a5dda77098e63c68beb398bf3d39d66671b4bd92fd24980bdfe9be227f707aa6a6a0c7fec12de00953ad50a97a7b14f741deb36363d01d99ec80884e41
- SSDEEP 1536:AlaIgacfRLrW1MdNCbWRh+r1b4w1YfOr63pvxfXHCCZGvS9Tkpg0Z0BK:wzEDIWOhbp1A3v/CJvS94q2
- TLSH T1F3A3124326AA4F18C7DAFD963237EB7FB0091C9E4457B6CE855B9142D831EA50583C3E
- MD5 SHA1 SHA512 SSDEEP TLSH
sample.bin
- IMPHASH 255014b9e2b55c5ae215d334deb1dc33
- SHA256 fa8cb2aa1efc7e1feb02c984bbb74ea434b6ebd3ce58053d8e2c1c08ff05583e
- MD5 6a6e5269e24f18580f27d4cd2f60e49b
- SHA1 fdb2a5e91125e9efca722d86d53f8170ee356d1d
- SHA512 2c83da99252828676786b4f18271aa4966b6106d4ab0433ec8d356679d31ed8ab9d05979c6f76074a9678fe7f62570b0cde2a89f19d602c3c4074282a0d5add7
- SSDEEP 3072:RB6CIRdquKZBvFRyFdLQfauQOjE1RLKYVd6L5BsY:CCIRIuKZQFeyu5jJMY
- TLSH T1FAF36B1BB7A401BBE5679139C9531A06F77278120B218BEF1794037A1F67391AE3EF60
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
25968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
GetFileSize
ReadFile
IsDebuggerPresent
CloseHandle
AddVectoredExceptionHandler
WaitForSingleObject
Sleep
GetCurrentProcess
ExitProcess
GlobalMemoryStatusEx
GetSystemInfo
VirtualProtect
VirtualQuery
VirtualQueryEx
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
K32GetModuleInformation
CreateToolhelp32Snapshot
Process32First
Process32Next
ExpandEnvironmentStringsA
RemoveVectoredExceptionHandler
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
HeapCreate
HeapFree
Thread32Next
Thread32First
SuspendThread
ResumeThread
HeapReAlloc
HeapAlloc
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
TerminateProcess
GetModuleHandleExW
QueryPerformanceFrequency
GetModuleFileNameW
LCMapStringW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
SetFilePointerEx
HeapSize
CreateFileW
WriteConsoleW
AllocateExpandEnvironmentStringsForUserW
ConsoleTraceLog
ConvertMultiByteByCodePage
ConvertUTF8ToUnicodeString
ConvertUTF8ToWideString
ConvertWideStringByCodePage
ConvertWideStringToUTF8
DosPathToExtendedLengthPath
DrawRect
FormatFileTime
FormatSystemErrorMessage
FormatSystemTime
FreeApplicationInformation
GetIconSize
GetSystemVolumeSerialNumber
GetTempFileNameAsUserW
HasMenu
LoadMUILibraryWithLanguageByModuleW
LoadMUILibraryWithLanguageW
LoadStringExA
LoadStringExW
LoadSystemLibraryW
NormalizeApplicationInformation
PanAdjustWindowRect
PanCreateLanguageChangeNotification
PanDestroyLanguageChangeNotification
PanGetColor
PanGetUILanguage
PanLoadMUILibrary
PanLoadMUILibraryByModule
PanQueryLanguageChange
PanSetFrame
PanSetUILanguage
PanValidateLocale
PrependModulePathW
PrependSystemPathW
QueryApplicationInformation
QuerySystemUuid
RegisterServiceStatusNotificationRoutine
RemoveExtendedLengthPathPrefix
SetConsoleTraceLevel
SetWindowStyle
UnregisterServiceStatusNotificationRoutine
WuActivatePrivileges
WuAllocateProcessThreadAttributes
WuCreateFile
WuDeleteAutoLoggerSessionRegKey
WuDeleteFiles
WuDllGetProcAddress
WuDllLoad
WuDllLoadEx
WuDllUnload
WuFileBackup
WuFileBackupByPath
WuFileCopyData
WuFileRestore
WuFileRestoreByPath
WuGetAutoLoggerProviderValues
WuGetCachedTicketGrantingTicket
WuGetFileRestorePath
WuGetFileSize
WuGetProcessCreationTime
WuGetProcessTokenInUserSessionId
WuGetServiceProccessId
WuGetTempPath
WuGetUsbDeviceDescriptorByUsbHub
WuGetUsbGetStringDescriptorByUsbHub
WuGetUsbSerialNumber
WuInitInstanceId
WuLoadBinaryResource
WuMarkDirectoryToDeleteOnReboot
WuMarkFileToDeleteOnReboot
WuOpenAutoLoggerProviderRegKey
WuOpenAutoLoggerSessionRegKey
WuOpenFile
WuOpenProcessByInstance
WuOpenProcessImpersonationToken
WuOpenThreadByInstance
WuOpenUsbHubByVolumeHandle
WuParseInstanceId
WuPrivateAlloc
WuPrivateAllocLarge
WuPrivateFree
WuPrivateReAlloc
WuPrivateReAllocLarge
WuReOpenFile
WuReadFile
WuRegQueryDword
WuRegSetDword
WuRegSetString
WuRemoveTokenSecurityAttributes
WuSetAutoLoggerProviderValues
WuSetAutoLoggerSessionValues
WuTerminateProcess
WuTimeToIso8601String
Name
.text
Size
95KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gehcont
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=137, id=261, version=27412,
count=4, id=264, version=27051,
count=14, id=260, version=26706,
count=9, id=259, version=26706,
count=34, id=261, version=26706,
count=3, id=257, version=27412,
count=115, id=1, productName=Unmarked objects,
count=3, id=261, version=27051,
count=1, id=259, version=27051,
count=1, id=256, version=27051,
count=1, id=255, version=27051,
count=1, id=258, version=27051,