Debug.rar
- SHA256 e8f74a9ddcfae0a59e022d1518a87dd2e0d2fdd64e90b7fa08e891c0055a6921
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Debug/Guna.UI2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Debug/Guna.UI2.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Debug/VirusBuilder.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Debug/VirusBuilder.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Debug/nasm.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Debug/nasm.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
General
- Target Debug.rar
- Size 961KB
- Sample261011-bws5yswt4m
- SHA256 e8f74a9ddcfae0a59e022d1518a87dd2e0d2fdd64e90b7fa08e891c0055a6921
- MD5 bdedf58f3fa36091f2a2689fb77566d2
- SHA1 638cfedeef7b5d24a756395424f9958d1086efd2
- SHA512 3a5da2ce945d9102a79a71c23d07cd20103278d5edc387f62551e0ccbd98ab5a95dbc404a9eeb89278769d48a6e580f4b4a7442f0c53f93df182ca62c1d35494
- SSDEEP 24576:8lCTm62Mgh/wt28yjkHMxAnkGIw8Kc8+KjEdrn/d/:8lW2MgJweg6mIw8KFgZ/R
- TLSH T1602533AA30F2F12D05764C54D9DBC8AD734CE99CA2D1B8C3E846C3B2BCA5B1EB159447
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Debug/VirusBuilder.exe unpack001/Debug/nasm.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Debug/Guna.UI2.dll
File Explorer
-
Debug.rar.rar 961KB
-
Debug/Guna.UI2.dll.dll 2.1MB
-
Debug/VirusBuilder.exe.exe 120KB
-
Debug/VirusBuilder.pdb111KB
-
Debug/nasm.dll.exe 1.2MB
Debug/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
0c:8b:14:20:bc:10:db:d0:29:b9:4e:67:9d:b2:a6:c7:df:c3:b3:87
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Feb 18, 2025
CN=Sobatdata Software
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 26, 2024 - Nov 25, 2035
Minor OS version
0
Major OS version
4
Entry point
2188846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/VirusBuilder.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 00936f3e71946e4a6c7d39695470853e320d8f632917a8495073bb17fcf712fe
- MD5 901f1993864635b07f8abbf6d7ce953a
- SHA1 b22b1b2846323d69f360cee4f0814f6d74b25b55
- SHA512 f7e3582230d3543d2a1b0bce5a927d5efa4986f8d544cb7724680d498d5f3bedef1fa08f6de5c8214eaf43216ce84e9d6f6200de6033f30fb975afe09d8615eb
- SSDEEP 3072:BOsa1i1GDLMAXbOVmXvu1uaWl6wbXd1uHZcHs8:Ysa1Z8IbqmX21uTlX1u5cHs
- TLSH T19FC3F7002AFB4B66E47F4BF94AFB5102437360236A78D6087EDD52E90FA33504A65F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
127190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\D0sa-\OneDrive\Desktop\MG.BuilderV2-SRC\SourceCode\MasonMBR\obj\Debug\VirusBuilder.pdb
mscoree
_CorExeMain
Name
.text
Size
116KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/VirusBuilder.pdb
- SHA256 28cd6af8952eb01915d0025c3f51b8c7678725c601831abbf3943160e3f2479b
- MD5 4d2c5ab6b2f4b7859a9d5400e57c176b
- SHA1 04f3a9b0cd916f3d706ff7f17b7bd4815c3aebf3
- SHA512 d53acee9401869efa7c93cf7e26b0b77d9a429e57c7b44b1bbf99777e40d3c4a78df65a6c642734e55cb47ba7820b11d717493abf8757d99400f822c76fc367c
- SSDEEP 1536:mTgVN59nVWu/RDBZmE14r8OXfJelRk64ZuOV8:mTADnXBc8O8lyyf
- TLSH T100B35257B780CA33C85985F45AAB4F3D5238ED804F8687CF27A4B66D2DF23A92D81354
- MD5 SHA1 SHA512 SSDEEP TLSH
Debug/nasm.dll
- IMPHASH 2cec3397f7a24bda80baf9df84308477
- SHA256 a4735165141570d966b577d594c0541c29baed4978078c1c7237b855f8592a87
- MD5 2f17bab79b9e5caa79c4f493a18fb06c
- SHA1 f3eb8a09529b82fc08e919517e098644ddc01004
- SHA512 37c62999e11f3a44c02bad2ad9941213c0264312f228de32466818ec84d745312f941f4adf6e4bf3f49d5d91e8df56dbf39b7966ed8d4b214b484c93635ca154
- SSDEEP 24576:2zYx3PgYWwocek/r2+AAYNh3tBULAkS7Le:2koA/qhlL3rmzS7
- TLSH T1A4459422A687D9A3C40E1270DDC7D32977B2E0F46B368B87BA4C97AF7D213A11CC5546
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
___mb_cur_max_func
__doserrno
__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__pioinfo
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_chsize
_errno
_filelengthi64
_fileno
_fstati64
_fullpath
_initterm
_iob
_lseeki64
_onexit
_setmode
_stricmp
_strnicmp
_vsnprintf
_waccess
_wfopen
_write
_wstati64
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getenv
isalpha
iscntrl
ispunct
isspace
isxdigit
malloc
memcmp
memcpy
memset
localtime
gmtime
perror
printf
putc
qsort
realloc
remove
setlocale
setvbuf
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strtoul
tolower
toupper
ungetc
vfprintf
time
_fileno
Name
.text
Size
252KB
Virtual Size
251KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
970KB
Virtual Size
970KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE