KRV FREE TEMP.rar
- SHA256 58e253d1c1645efc4939e24af0540e31f65e8ee0f46d1d1b4950aaa71d27c09a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
KRV FREE TEMP.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
KRV FREE TEMP.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target KRV FREE TEMP.rar
- Size 16.5MB
- Sample261018-rmda5sfs2x
- SHA256 58e253d1c1645efc4939e24af0540e31f65e8ee0f46d1d1b4950aaa71d27c09a
- MD5 e41e02c5c28f20b4d325b3d51ff8c689
- SHA1 031b30a5de7931cc2460e569f17d84a562602b32
- SHA512 81d17a502f1ad7cc0e0ec3589c17a272b732dea1a72ed57e39df1e0e93932c3f143dbc52c694ac5b64f008279514272ae7ca34d63d1c17705b44cfe5ee0e6302
- SSDEEP 393216:ROmeoZXXn+rqT3k5C5s1GGRo+SAN0Lu9r52dKK:RDeeXI+085soGRc292KK
- TLSH T1FE073319585BE4D0D0B3211239C9F98388EEE5DC768A2238EE3997FF951D8681DCCD36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/KRV FREE TEMP.exe
File Explorer
-
KRV FREE TEMP.rar.rar 16.5MB
-
KRV FREE TEMP.exe.exe 19.8MB
-
Lis moi .txt36B
KRV FREE TEMP.exe
- IMPHASH f87b85fddbeea39a43ff1cf0d3c34d44
- SHA256 77e3c34f10b69063135f3710826973843adc319a0c18f7ae9678be97d91b210f
- MD5 35126f34fda0899e70d8f580b9a50570
- SHA1 2045baa6da682f06b71e96a5503963869cc1de2d
- SHA512 6922b41af927512d42231cb9227238c4dc9eccfbfe455fe27f9d86aca8c8bced4781552f7bdd049436067ff5bfdea1b66ae087b36bc87d62435f5018feb5ffef
- SSDEEP 393216:pSgFEpvVzAZjl8ELQhuT41T025QfviHWnJJmdQVtUb1qpu+g:pSpvVzAtJSuT4Z/QniHWJcCib1qpj
- TLSH T1A02712D528D083FCC742C639D24A16FAE6C938968EBA891B7FC658023571C55C8F7E39
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27186943
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
QueryPerformanceCounter
user32
GetMessageExtraInfo
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoSetProxyBlanket
oleaut32
SafeArrayGetUBound
msvcp140
?_Xbad_alloc@std@@YAXXZ
imm32
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-math-l1-1-0
roundf
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
719KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.W``
Size
Virtual Size
11.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.>+m
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.p,T
Size
19.8MB
Virtual Size
19.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Lis moi .txt
- SHA256 8837b77fc0d9f81b87c79b8a846a85202306e41953dd0beb694b24a81a2c5304
- MD5 3568b9578f4ae2a5b12dc4af03e8fe0c
- SHA1 1607f46f0a6c7b1da5d62cad27b9875bd65aa7cf
- SHA512 c8e2bb67b428e704550d894abdee4b389af26b0b67c43b9b4f37b9834af9e74ffcf9a521d8429819990cb53e3b8587e3d8428b4c6bc8ffe72eae3adafe079976
- MD5 SHA1 SHA512