59f0504df2b612435403f6cb5e90e79c0e2c12a9e5444d7ff46cdaa7dc2ae51d.bin.zip
- SHA256 59f0504df2b612435403f6cb5e90e79c0e2c12a9e5444d7ff46cdaa7dc2ae51d
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Application.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Application.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
cert.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
cert.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
util.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
util.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 59f0504df2b612435403f6cb5e90e79c0e2c12a9e5444d7ff46cdaa7dc2ae51d.bin.zip
- Size 475KB
- Sample261006-kq77csvbrf
- SHA256 59f0504df2b612435403f6cb5e90e79c0e2c12a9e5444d7ff46cdaa7dc2ae51d
- MD5 9c02df2046f03d0bd957c621b0911fb1
- SHA1 67ba799fcb288842d8b1b31780b329bc29f75356
- SHA512 f7f95fa0550875d9adb28e70a52942c4f177b20a4668040017f581cc6e9973fdd4deb6ce3bbed4b4141e161520eafe5afc1637df18f2bb2b15b95710be142546
- SSDEEP 12288:or06tUv4SnAQPKTYNk/wm+iTcchv4xtHYc2OnZV:or06tUv4t1cNk/wjibhv4b2Onn
- TLSH T12AA4238274716D0AC096CFBDD4C1AACAD06A023D35663BE5639294CABD940367F9BF13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/util.exe
File Explorer
-
59f0504df2b612435403f6cb5e90e79c0e2c12a9e5444d7ff46cdaa7dc2ae51d.bin.zip.zip 475KB
-
Application.cmd25B
-
cert.txt.js 177KB
-
util.exe.exe 742KB
Application.cmd
- SHA256 7c4f3e09c6428d0a0d7d85615695f5fedb35bb4e7180d31e1f8a1bacf22e5639
- MD5 17d94f34b9d15449b03bc099a637782b
- SHA1 eb474f898256e8e7baaf0d63b306d1169e637c73
- SHA512 0cc764b39983867bbb53bf83563c8bf15d97d921e2a0c1148abeed7df73e1c79f2cac57ea69c9f5fcfadf2cd91bc12756a2ff6f682c77172b7df74f144cbdc38
- MD5 SHA1 SHA512
cert.txt
- SHA256 a75561a3224d9f836058a6d0204ed2e6c1f638275a59495935cd2a5e46fd28ca
- MD5 ccfc0f145861f23c6850c691c4be54b9
- SHA1 b88ac887493f31cf9f160ddbc6bc3a2aa298a0ca
- SHA512 6c2b3f700cf2b88d37cc0f1fc1cd33708d7aef344a58634d3f01a1f0c5c0a786825fbe779bf5315fc520edb5cc85409854e7cf6d8b662eb9106ffaecd7e7e801
- SSDEEP 1536:y6huLAUgg2x/NbW/w5XcuMcGlQg0TX0M5qllHhOu85YNNM+095F9gR4RA+hckK+9:1hucU+Jv5klHJf01O4Wc
- TLSH T10D049796518D5CBEE7D7C190DC8BACAB35B380D4078E364B0F50D0A536E1766DACF88A
- MD5 SHA1 SHA512 SSDEEP TLSH
util.exe
- IMPHASH 0d8f96525fa416afffa287da796d1f5e
- SHA256 e227d47facf0e2f5b9e5c54a23a86b31272696b64bbbb9932a31fe06973677bd
- MD5 7a59df9ee2ae38c391b60c001d8fef11
- SHA1 a5fa49ca3da03fb01f2a96fa99521f263665f9ff
- SHA512 8237b3fd2a41a08bfb8ca95060e1a7f8b030538d587746b1b050d1ce0f2a6f4898ff31e65243c97e6b343a8112159839cfa85f47ecffc20a621dac64cf947b7a
- SSDEEP 12288:PFsr3uNFZnKsXrLdiu7c7nu86VDfU/+tZxMUJ4EBiSxsyYA:PFs4FZnKsrLdiCUMs/KiesyYA
- TLSH T184F4BF81B6D381F3D992117148B9A77A0E3D6D1007259CEB83D43AF68D346C0AF776AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
383313
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\defold\defold\share\ext\luajit\tmp_win32\LuaJIT-3e223cb8a41cff3b92931acb846af7b67a5d2537\src\luajit.pdb
kernel32
RaiseException
GetLastError
SetLastError
RtlUnwind
GetProcAddress
LoadLibraryExA
VirtualAlloc
VirtualFree
VirtualQuery
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep
CreateThread
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
FormatMessageA
VirtualProtect
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
SetEndOfFile
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
ReadFile
CloseHandle
DuplicateHandle
CreateProcessW
QueryPerformanceFrequency
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
DecodePointer
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
CreateFileW
GetTimeZoneInformation
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
MoveFileExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
WriteConsoleW
__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s
Name
.text
Size
620KB
Virtual Size
619KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=55, id=259, version=33145,
count=205, id=261, version=33145,
count=26, id=260, version=33145,
count=3, id=257, version=33145,
count=110, id=1, productName=Unmarked objects,
count=26, id=259, version=35207,
count=18, id=260, version=35207,
count=38, id=261, version=35207,
count=1, productName=Unmarked objects (old),
count=68, id=260, version=35225,
count=1, id=256, version=35225,
count=1, id=258, version=35225,