16ba060f71d503f4ff1a1aff26c9dcf067a04249db394a4eb3a1ba1ca1d74f0c.bin.zip
- SHA256 16ba060f71d503f4ff1a1aff26c9dcf067a04249db394a4eb3a1ba1ca1d74f0c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Launcher.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Launcher.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
bytecode.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
bytecode.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
gcm.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
gcm.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 16ba060f71d503f4ff1a1aff26c9dcf067a04249db394a4eb3a1ba1ca1d74f0c.bin.zip
- Size 529KB
- Sample261006-kq77csvbrd
- SHA256 16ba060f71d503f4ff1a1aff26c9dcf067a04249db394a4eb3a1ba1ca1d74f0c
- MD5 79953f3cb8c06e922a8cf79c0ffa3e70
- SHA1 06011470ebe61716af625858acb1bc12a7f6c838
- SHA512 c9f729f62058fd4f8697e4e95196137f93126bb45b3c7f3aa80bdb034b5c91033b470029a8ecc6a07942d1ad1630cc08a0ded50875dac5346d40f5f6a3e81258
- SSDEEP 12288:17JZAaFpeOqO3g/ALyYG0ZaDajTCXMO8xzDOe3We:pLpeEA/f0Za6TCXKBxme
- TLSH T16EB42369227F71900C7543A84B468124FC3E5EB2AE00DD93EDDCAB4D8F5BB195638E0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/gcm.exe
File Explorer
-
16ba060f71d503f4ff1a1aff26c9dcf067a04249db394a4eb3a1ba1ca1d74f0c.bin.zip.zip 529KB
-
Launcher.cmd26B
-
bytecode.txt.js 292KB
-
gcm.exe.exe 753KB
Launcher.cmd
- SHA256 3f4c88d65a5b792d3234a8cb966154550f1d9b9eaefd2474c01f97b21f46733c
- MD5 cf304da0c9eadcdbe38ebe7e5d005be5
- SHA1 2c199e7c209bc250c1fe762cf66d0872cdd8541b
- SHA512 ecdbf6b1a349a816958f90a2edaf2acdabe01e7ee1ba44f4fa1a4e36495d80b8883f3b4f988174a9a3379428b82ca8d001d22b967c9ac18a6718dc5fa0306450
- MD5 SHA1 SHA512
bytecode.txt
- SHA256 35d19eba58c4db6e034e7965ac41a2b02a26f26ca9cfcfb5ec8cb1690ec86c5e
- MD5 61b31acc14f126f5ce3692a52e374952
- SHA1 6b4c2b778419843a3a8df142479f6ddcad34c331
- SHA512 2254fb51e6fa3c249820c67706cdafdac38fea8043acaccc1781f35fe5394cc1b277e082e69e9246d981540662d7e4755f40b6370922388573fc6f61b1265fe6
- SSDEEP 3072:OjQnaGjewTWqwOqX9E5s650QllqpvsunFS1BjWC7ojS4l5qWaves5:dYuRqAqtsGFEJWnOb
- TLSH T14554F7F1648C08D1DAAB8694DC7EEDA7127725F14B4A268BCF1DF4E83750690CADEC06
- MD5 SHA1 SHA512 SSDEEP TLSH
gcm.exe
- IMPHASH cbeef51b8ba9e626e4d1abaf147dae7a
- SHA256 4c469dadda5529047b063dd2e91ec36c409b4cbe6cf3576ae7db02e79e4d51f7
- MD5 4b4e5b23962b294bc3699ffccc85b7c2
- SHA1 1d26e2bc9f12734e82d174fee5767e7b8be91d6e
- SHA512 8cac7e740626f2ccfd8b9524423d19c89624cb70d532a0c563df6a0be51eeeda1c7124699bd91fe648cb339688846192ddcdc0c123168e0226ea36728265a5c5
- SSDEEP 12288:6Ixb6mgscIPv+xPBPx3ph7WfsnE6VTdUZ9nUt2ZvIX/19X7BroFkLwqG:LlRcIOXrh7dEiTWZC8gXTFF
- TLSH T128F49F19FBB101FAD5B78135CD16A90BEBB2BC050624566F43E06AAB6F377210E1F325
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
331080
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
RtlUnwindEx
RaiseException
GetLastError
SetLastError
VirtualFree
VirtualQuery
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
CreateThread
LoadLibraryExA
FreeLibrary
GetModuleFileNameA
GetModuleHandleExA
FormatMessageA
VirtualAlloc
VirtualProtect
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
RtlLookupFunctionEntry
EncodePointer
RtlPcToFileHeader
GetCommandLineA
GetCommandLineW
SetConsoleCtrlHandler
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
ReadFile
CloseHandle
DuplicateHandle
CreateProcessW
QueryPerformanceFrequency
GetStdHandle
WriteFile
GetModuleFileNameW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
GetTempPathW
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CreateFileW
GetTimeZoneInformation
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
MoveFileExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
SetEndOfFile
RtlUnwind
__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s
Name
.text
Size
608KB
Virtual Size
607KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=259, version=30795,
count=206, id=261, version=30795,
count=23, id=260, version=30795,
count=3, id=257, version=30795,
count=109, id=1, productName=Unmarked objects,
count=10, id=259, version=35403,
count=18, id=260, version=35403,
count=40, id=261, version=35403,
count=1, productName=Unmarked objects (old),
count=64, id=260, version=35724,
count=1, id=256, version=35724,
count=1, id=258, version=35724,