lanipscanner.zip
- SHA256 2a5f288d8d39277a34d22f2bc3e046d261b729e51051a8f35430b8914a3d5701
Behavioral task
behavioral1
Sample
LANIPScanner.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
LANIPScanner.chm
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
LANIPScanner.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target lanipscanner.zip
- Size 463KB
- Sample261015-pgcfjstwdx
- SHA256 2a5f288d8d39277a34d22f2bc3e046d261b729e51051a8f35430b8914a3d5701
- MD5 09cccd900afb6c8e8273c71c57e02d35
- SHA1 e2a6f97229eb95a5599db4290e884e73d2ba6d5a
- SHA512 8c5333d80dd156a8c8cb151b95c9738b8af693d426ab32e1770dbc6af359495669154368cc50d0894d9b7a5c8378e7e4fdc0e52377ce18e5b90a2f9edbbecfb9
- SSDEEP 12288:fr2MFzM/HM2ww7/fIUyKZu0NEG+WHAJcnt9nRR3g:lCvM2+n0CpWH1LnLg
- TLSH T165A423995B6C1400D0C531B35C4B46DF112392C788FE951B9859EABC7EBEA8ECCDA09E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/LANIPScanner.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/LANIPScanner.exe unpack002/out.upx
File Explorer
-
lanipscanner.zip.zip 463KB
-
LANIPScanner.chm.chm 16KB
-
LANIPScanner.exe.exe 464KB
-
out.upx.exe 1.3MB
-
readme.txt7KB
LANIPScanner.chm
- SHA256 6834835520bf0ee60a4255b520b036ad47aa6b636b02f3ed9d40add8ac47d5ad
- MD5 a2c2aac82560798e044aecded3317a78
- SHA1 9b22b2fbadc5055a2ab12064db6dd333502cc9db
- SHA512 8456b4c95b9f413cc0a46bdeed3bacdb51f167220cc0404cd42270894279e9a8f88a4902dde32006bfffee48d9d40462f9d1531b81b65cb00ac1bdac0748e63c
- SSDEEP 192:A3Yic0ocdcX7VCYBD+v3dEY/VWYAFiGGXkMZwApYQac7TRRb:A3PdaX7VFqNN9fUMKAnRR
- TLSH T1EE72BFBA7B158763DA15C1761BDF8885B12CFE61E7F444BE166BA24C883C204C3E349D
- MD5 SHA1 SHA512 SSDEEP TLSH
LANIPScanner.exe
- SHA256 7552aa3dec2ea67674ad19023389fb4809605c017bfc06bf23fb6da65da8ef5a
- MD5 ac6df20b37cffbd6d6320c7f4fc9a4b4
- SHA1 53abda90d2eac17c2e06b103c7c17650fc1f656b
- SHA512 7f2790f0621b1aedf2ad0f1ffb382e04b9b31d09226aa4cd5784309eb12ed2ee79b872e2518f2c5d203dcbb4142fc0458b018a5893ed5bf77d15c90307fa2d02
- SSDEEP 12288:voJxt6FuUaj5y4pREeXe/j0rv2gpieDrHCPXeRowNhcNVs13sSyvh:+65aNoj0r/DLCPXSq3zV5
- TLSH T1C0A42324F32032EBEBF96B37690B781E1D4C3E6B99DF470A768004B5DED5059A324396
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1417024
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
928KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
452KB
Virtual Size
456KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=20, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=338, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=41, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 c8fd35096e3c2370796e8c19e7f8823aa28e6299da11634b8c0fd5f45341247e
- MD5 d67385b20d62140c9e3b952d94fd27a6
- SHA1 fba41bed1b9adf2e9fb80e6e4f37f9e4610b95db
- SHA512 e3579375949791d520a66f811c909fde60de92a0511ec0451ef081b275a77a3469dd43a47aecc5f3d41fb12e1d2bc31fbe3976f942cc56c5eda25a456da3a32e
- SSDEEP 24576:t9xXSK/Rkqm7TF9GZRrZm9m5qE5fhGw9sC9oYmLVcn927AjU+dgTumdbxTY6JC3f:dB/Rkqm7TXGfrZm9m5qE5fgw9V9oYmLw
- TLSH T19255D6D4763FB1B2E74E25BD36822EC51A3E6A8C311C53127239849090FB8AF77D895D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=20, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=64, version=9210,
count=11, id=28, version=9178,
count=338, id=1, productName=Unmarked objects,
count=3, id=25, version=9210,
count=41, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
readme.txt
- SHA256 b85f0e71ebe8336aecb326025e215069e330c62bb4bfb3e334c8e28cb576d601
- MD5 bffc64a0fe8576bf2558e1f232f12487
- SHA1 a7fa4843189d1e17c11b6787843ee0120f4dcb73
- SHA512 4bdfcbab2e21cee7994cf4aaf99af8ca99f9ab2eef68bfd9718f6fd54f781ad60cbb0ed11e60eb45196601fc2a3e54145baf2f12a4a7b1e63d6112fcb17a8f08
- SSDEEP 96:mWUSrU8gH8HVnaEGFhpWJ7uq6xarMV7oNLqh7o5c23fCoadzyoa0uk1lIangXFUt:mWUSx1aXnV7oNLqVmX3fpkS048sI+i
- TLSH T155E1610F7B56137515B34095668C77A2E32A40FCE21A45F9346CC12C1BF277296FB2AD
- MD5 SHA1 SHA512 SSDEEP TLSH