Release_x64.zip
- SHA256 85f3ea0db78e54fa05c819702c67b8a724d51fbc9d787007b69cb631e9d9efaa
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release_x64.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
LICENSE
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
SickoMenu.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
version.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Release_x64.zip
- Size 3.4MB
- Sample261014-s13cvsxtev
- SHA256 85f3ea0db78e54fa05c819702c67b8a724d51fbc9d787007b69cb631e9d9efaa
- MD5 79982f4817ac6c4a0d06ef2affe3dfb0
- SHA1 84826699dec17fb62534a919bbac0f53b74641ee
- SHA512 c55364b5a84450cc8868680e9a310a5bb65ba2c72b9e83bf2cdd71a8ecd61b3460ebea65bd620b50da7d675ba549e8cc15ca1095bc94da3e4bb6e1951c05a2f3
- SSDEEP 98304:bwYXUOgCm0Ub4kSD9O3EqdwT9bOifDowP:bwYXfIkkYE33G9KifD1P
- TLSH T120F5332BD15CB08E9590E9336F01FE2C6DED8F43A56D9B1AE5D6B1E3048CBA01CD2436
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SickoMenu.dll unpack001/version.dll
File Explorer
-
Release_x64.zip.zip 3.4MB
-
LICENSE34KB
-
SickoMenu.dll.dll 3.8MB
-
version.dll.dll 3.8MB
LICENSE
- SHA256 230184f60bae2feaf244f10a8bac053c8ff33a183bcc365b4d8b876d2b7f4809
- MD5 e62637ea8a114355b985fd86c9ffbd6e
- SHA1 1eba7caf09a39110ad2f542e3ed8700d1a69c6d3
- SHA512 714d66c4a17e6dfc1553521af2be03f4579fac64048c0b96c592177562b01fc70a8e184bb21725e11ef96a54bf466ae1abd4992b8940f0fe2c0859d6a166a2ef
- SSDEEP 768:l7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD9I:lVtNIq1uzZY1w
- TLSH T115F2825FB74513B205A202526E4FA4DEE31DD07A376A00657869C15C23B7E3483BFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
SickoMenu.dll
- IMPHASH 8467405a00d74a77e3b6f6139f876d48
- SHA256 90610fd4042338e98a57d2636501c4e9a6759cc0f4219e7f2844887bdb6cc381
- MD5 96af9d49ed3ac54cf23c3dcc6d59dddb
- SHA1 e8cefd0b6906bb24fc1cbf0540639eb567e8ad57
- SHA512 eae0c96ae7288784612f5c0b9c1ff1b3d128f4612cd73a671cd8ffce53700a3c44b81a1501bee5f7b1cb643a525c3299e858683b399fa6537857d7200af3b8ca
- SSDEEP 49152:Hwhc4vLTROfNvsvBFNX/mz1Cy2AKnaXcdbqbKc4zNZTA/c2ETowetlX/Gihon3pO:nfjKn2G9AXwjJn30
- TLSH T13F068D1D37B801B9D2E5D979CA876D13F973388603319AFB069146665F2B2F14B3AF02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2072728
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
CreateThread
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetModuleHandleW
QueryPerformanceCounter
ExitProcess
SetEndOfFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
OutputDebugStringW
WriteFile
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
CreateSemaphoreW
CloseHandle
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
WaitForSingleObject
ReleaseSemaphore
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RtlPcToFileHeader
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
WriteConsoleW
ReadFile
HeapAlloc
RtlUnwind
user32
SetWindowLongPtrW
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
MessageBoxW
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
CallWindowProcW
GetWindowRect
shell32
ShellExecuteA
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1019KB
Virtual Size
1019KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=189, id=261, version=33145,
count=40, id=260, version=33145,
count=24, id=259, version=33145,
count=15, id=260, version=35207,
count=12, id=259, version=35207,
count=98, id=261, version=35207,
count=13, id=257, version=33145,
count=225, id=1, productName=Unmarked objects,
count=105, id=265, version=35229,
count=1, id=255, version=35229,
count=1, id=151,
count=1, id=258, version=35229,
version.dll
- IMPHASH 65bdbcbf0affa0d22e703a34159cfae5
- SHA256 97988357101cc02d4270e5fdf888076c978b9c3b25b7194c1e80d27e4e2b78ca
- MD5 582df9997c1c30ae77b8b40938cbe181
- SHA1 a1bf6d1f07823b21e18ed1115117d86db60c88c7
- SHA512 d12f3dc82a82faaa054c9cbff76117bbed410f9a5d3c61850b21fa0695d56421e5c3008951a9bf3245c15c38264eefd0842c1605b4956143ae971b2427baec05
- SSDEEP 49152:IzxWMU7HA8TZJcntVID7VKFpwwe/D7/z0b/wtXofjp7FgOEvnjz+rPznuOkbddGk:INZktfIb/3PAXyIiH30
- TLSH T16A068D1D37B801F9D2E5D878CA436913F973388603719AFB169156666F2B2F04B3AF12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2074520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
CreateThread
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
ExitProcess
GetSystemDirectoryA
VirtualProtect
SetEndOfFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
OutputDebugStringW
WriteFile
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
GetModuleHandleW
CreateSemaphoreW
HeapAlloc
ReadFile
CloseHandle
WaitForSingleObject
GetCurrentProcessId
ReleaseSemaphore
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RtlPcToFileHeader
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
WriteConsoleW
RtlUnwind
user32
SetWindowLongPtrW
GetWindowThreadProcessId
FindWindowExW
IsWindowVisible
MessageBoxA
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
MessageBoxW
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
CallWindowProcW
GetWindowRect
shell32
ShellExecuteA
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
?_GetFileVersionInfoA@@YAXXZ
?_GetFileVersionInfoByHandle@@YAXXZ
?_GetFileVersionInfoExA@@YAXXZ
?_GetFileVersionInfoExW@@YAXXZ
?_GetFileVersionInfoSizeA@@YAXXZ
?_GetFileVersionInfoSizeExA@@YAXXZ
?_GetFileVersionInfoSizeExW@@YAXXZ
?_GetFileVersionInfoSizeW@@YAXXZ
?_GetFileVersionInfoW@@YAXXZ
?_VerFindFileA@@YAXXZ
?_VerFindFileW@@YAXXZ
?_VerInstallFileA@@YAXXZ
?_VerInstallFileW@@YAXXZ
?_VerLanguageNameA@@YAXXZ
?_VerLanguageNameW@@YAXXZ
?_VerQueryValueA@@YAXXZ
?_VerQueryValueW@@YAXXZ
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1021KB
Virtual Size
1021KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=189, id=261, version=33145,
count=40, id=260, version=33145,
count=24, id=259, version=33145,
count=15, id=260, version=35207,
count=12, id=259, version=35207,
count=98, id=261, version=35207,
count=13, id=257, version=33145,
count=229, id=1, productName=Unmarked objects,
count=106, id=265, version=35229,
count=1, id=256, version=35229,
count=1, id=255, version=35229,
count=1, id=151,
count=1, id=258, version=35229,