6336b1a886d5b84480eade15f0c9b9fb510fe0f02a8501b5ab08229075985086.zip
- SHA256 678f0e3be391de494127e81731c0a229cff9346a31c6e49e147a07cf9097bcb9
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6336b1a886d5b84480eade15f0c9b9fb510fe0f02a8501b5ab08229075985086.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 6336b1a886d5b84480eade15f0c9b9fb510fe0f02a8501b5ab08229075985086.zip
- Size 497KB
- Sample261007-3rr6msht6n
- SHA256 678f0e3be391de494127e81731c0a229cff9346a31c6e49e147a07cf9097bcb9
- MD5 24e0fd61a3aaf85f4aec3be84c6505bf
- SHA1 11994778586c9c8f8d2cb79c4b6a1574fedca91e
- SHA512 c6952945c9dc1b0ebabc8dbf78b397ba3de2c9c6465b50bf84c39ca68ecc151f3f3835c614f68f3b22dacccbb6676dd26097a791af765b0214e874d26b501891
- SSDEEP 12288:CRon9c/8hqOmzRBUl8CUpu+/iJ61pQ2j6Mjc7kX6wlGgi+JFEI:B9WUQRillUpuxUkM226wogxl
- TLSH T177B423BD1AD091B09834A9582D4C598D34AB0446ADB56F4A856EF0BBC77C808BDF3FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6336b1a886d5b84480eade15f0c9b9fb510fe0f02a8501b5ab08229075985086.exe
File Explorer
-
6336b1a886d5b84480eade15f0c9b9fb510fe0f02a8501b5ab08229075985086.zip.zip 497KB
-
6336b1a886d5b84480eade15f0c9b9fb510fe0f02a8501b5ab08229075985086.exe.exe 588KB
6336b1a886d5b84480eade15f0c9b9fb510fe0f02a8501b5ab08229075985086.exe
- IMPHASH 9da7080b9b697496fd4f41997e8bd436
- SHA256 6336b1a886d5b84480eade15f0c9b9fb510fe0f02a8501b5ab08229075985086
- MD5 29fc322ceb5f47f5596018e502a3f619
- SHA1 25718aa0f21434181c76f8247b1cf0dd56c980ca
- SHA512 d0ebb42b89b5aea6a7b581180cde6e91918696da001d0042ab9f4f193c41452341b55fd6f5a5fb9a9dac5d62c875d2cc0c802598f651521e224cf8b570228e05
- SSDEEP 12288:TEzPL/FzLf8SRjCGkbtsh6oGEiQo/BjlAVolFPFtUfpZs:4zPtfhjaG6JuGBmqvws
- TLSH T1ACD4F11553E800A6F0B66B7498B24A9799327C21AFB492FF13C4A17D1F336C5A536F0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
10
Entry point
4864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wextract.pdb
advapi32
GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges
EventUnregister
EventRegister
EventWriteTransfer
kernel32
_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetModuleHandleExW
GetDriveTypeA
GetShortPathNameA
lstrcmpA
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
ExpandEnvironmentStringsA
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
LoadLibraryExW
GetExitCodeProcess
MulDiv
LocalAlloc
SetFileTime
GetDiskFreeSpaceA
EnumResourceLanguagesA
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
Sleep
FindClose
FindNextFileA
GetCurrentProcess
FindFirstFileA
GetVersion
GetModuleFileNameA
LoadLibraryExA
gdi32
GetDeviceCaps
user32
MsgWaitForMultipleObjects
SetWindowPos
GetDC
GetWindowRect
DispatchMessageA
ShowWindow
DialogBoxIndirectParamA
GetDesktopWindow
CharUpperA
SetDlgItemTextA
ExitWindowsEx
MessageBeep
EndDialog
CharPrevA
LoadStringA
CharNextA
EnableWindow
ReleaseDC
SetForegroundWindow
SetWindowLongPtrA
GetWindowLongPtrA
PeekMessageA
GetDlgItem
SendMessageA
SendDlgItemMessageA
MessageBoxA
SetWindowTextA
CallWindowProcA
GetSystemMetrics
GetDlgItemTextA
msvcrt
_fmode
_commode
?terminate@@YAXXZ
_acmdln
memset
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
memcpy_s
_vsnprintf
memcpy
comctl32
ord17
cabinet
ord20
ord23
ord22
ord21
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
520KB
Virtual Size
516KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=33145,
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33145,
count=20, id=260, version=33145,
count=17, id=257, version=33145,
count=167, id=1, productName=Unmarked objects,
count=10, id=264, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,