4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.zip
- SHA256 0e748c1a37ed951f41a397d0f2ff8a02f8522a7f41c789c5e61deffb4ac882ab
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
General
- Target 4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.zip
- Size 415KB
- Sample261016-v4t7rss18l
- SHA256 0e748c1a37ed951f41a397d0f2ff8a02f8522a7f41c789c5e61deffb4ac882ab
- MD5 317dccaad34803188cedaed2a301c5a7
- SHA1 ab19f88d83d6a88d17750ecfcac450fee2c93729
- SHA512 a21a04ff03c558062c1411f564f6f1109603c5e5574b8653be47dc090fe95af25c94bc18282f857c08a36701c1bbc315735643449ce40338f203a4f34fde3dfc
- SSDEEP 12288:lg1xvSxq9De6bMdvZAtdSRMDdpGmkWjae7k:JIqgM8rSRMDdovWj1k
- TLSH T1039423623396360F84FE1B3B07C496E7396E5A570B46E08275131C6A9F674BBA04CF8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.exe
File Explorer
-
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.zip.zip 415KB
-
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.exe.exe 1.0MB
4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c.exe
- IMPHASH f89d971f855e5743dd4d1e73a5da5699
- SHA256 4f16317dba9b983bf494892dcd227c0795f3809303e3b2787bf0a2193a318e0c
- MD5 d68c82bfa227f4f8e10f640d1c5b341e
- SHA1 6c8f4ce06ea61feda5c70bf35ccc35fae5f20898
- SHA512 1c0b69f8843b0ac0225054bfc04294de9e01f1fb167da43673c1577177ffcbfc98f5c5f483bd237c4f9273ec747774aae14dbfb6ee4929825378fa281df64733
- SSDEEP 24576:zQagXrs6xiS7Ay/i4NBqThb23KAwcCcoVRqs:zQa36bg4NBqT1VAwfcoVx
- TLSH T1F9352941A5164AF6F652CABD4A32C42FEEF736050B10DAE75581B23A2F030E92F7C759
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
580920
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
WaitForSingleObject
PostQueuedCompletionStatus
GetLastError
SetEvent
TerminateThread
TlsAlloc
CloseHandle
QueueUserAPC
LocalFree
DeleteCriticalSection
TlsFree
FormatMessageA
ReadFile
GetFileSizeEx
SetWaitableTimer
TlsSetValue
SetLastError
WriteFile
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
GetCurrentThreadId
CreateEventW
SetFileInformationByHandle
DeleteFileW
CancelIoEx
SleepEx
TlsGetValue
CreateIoCompletionPort
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetDriveTypeW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetCommandLineW
GetStdHandle
WriteConsoleA
GetDynamicTimeZoneInformation
Sleep
GetConsoleMode
GetFileAttributesA
GetSystemInfo
GetCurrentProcessId
GetCurrentProcess
GetProcessId
OpenProcess
ResetEvent
GetLogicalDriveStringsW
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapSize
HeapReAlloc
GetLocaleInfoEx
RtlPcToFileHeader
RaiseException
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetStringTypeW
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
RtlUnwind
shell32
CommandLineToArgvW
ShellExecuteW
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
ws2_32
WSAStartup
WSACleanup
shlwapi
PathIsNetworkPathW
mpr
WNetGetConnectionW
wtsapi32
WTSEnumerateProcessesW
WTSFreeMemory
rstrtmgr
RmShutdown
RmStartSession
RmEndSession
RmRegisterResources
RmGetList
Name
.text
Size
818KB
Virtual Size
817KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
33KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=259, version=27412,
count=19, id=260, version=27412,
count=181, id=261, version=27412,
count=1, id=262, version=27412,
count=16, id=260, version=32533,
count=10, id=259, version=32533,
count=3, id=261, version=32822,
count=23, id=260, version=32822,
count=100, id=261, version=32533,
count=19, id=257, version=27412,
count=206, id=1, productName=Unmarked objects,
count=9, id=265, version=32822,
count=1, id=255, version=32822,
count=1, id=258, version=32822,