net8.0-windows.rar
- SHA256 1c8ace9a9ff61bc337f26e561a9a34b76d82b6db05a08b0b835df41b419e9022
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
net8.0-windows.rar
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
net8.0-windows.rar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
300 seconds
General
- Target net8.0-windows.rar
- Size 73KB
- Sample261023-a1chbsbs8r
- SHA256 1c8ace9a9ff61bc337f26e561a9a34b76d82b6db05a08b0b835df41b419e9022
- MD5 ec4fa301a8e08a319ff7123b051c9870
- SHA1 c6684053bd4fbaebf296568fe225783bd0b9c2aa
- SHA512 ca24a974b47d7d8d7773ddf6ff133c87ccbe8883831712b2f1b4f968831e5a6572c1f8447ac6e8d86a9c372e0009baf2c165b846dfaa4b5419f7718836c12718
- SSDEEP 1536:yOywc1yy8qYnJbacZLprKc3gH9IgMdbxv1fu5qCm9vKAwhb:ewc4ycJLLAaglMdbxv1d9vKdp
- TLSH T1CC73123170A834E2F5A510D372C6F947DA7F26AADED1D68B65F4C0847F90A36C4AC2B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/net8.0-windows/Mei Mei Virus.dll unpack001/net8.0-windows/Mei Mei Virus.exe
File Explorer
-
net8.0-windows.rar.rar 73KB
-
net8.0-windows/Mei Mei Virus.deps.json431B
-
net8.0-windows/Mei Mei Virus.dll.exe 14KB
-
net8.0-windows/Mei Mei Virus.exe.exe 148KB
-
net8.0-windows/Mei Mei Virus.pdb14KB
-
net8.0-windows/Mei Mei Virus.runtimeconfig.json443B
net8.0-windows/Mei Mei Virus.deps.json
- SHA256 b1862f4b1e5da014af563ca8734c7aff928b4f13e7b977268507c2aaeed15ec3
- MD5 0977d6fbd21f663c092dd45627f2020f
- SHA1 72f94715e290eee7f2e3b679a7aaf6135aa409f2
- SHA512 4003694f3669fe1f267b78e64c218408e5027fd611a89bc445a5dce8eda8b02694561a7c9e069b35ae11a5114640b6db4676a7220463b4bbfd3c42f368df977d
- TLSH T1D0E09A0ED7C40EA700B223B294369383F53377670121188A79FE882C0F7291B54A0F6D
- MD5 SHA1 SHA512 TLSH
net8.0-windows/Mei Mei Virus.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 75523a358c28f8745bdca2c05c6535368be5b3efb25271535c6e7ddf22dfebbd
- MD5 7fda72a894eb577136157ebb26178534
- SHA1 24144a0e71df2add93a22858f858786829faedd4
- SHA512 7be09702e7787efc06fba7d158e87f31d3885071ce4f7d0c9c94d789247d7efdb2842e27fcde2ffe670c3660bf48b842ea16cad105df5c8603cd9b664d115863
- SSDEEP 384:p5KqinhxanzLrZw6LJqoXUCHf4zL3LTDcwUl+pb4fYK3:Enwzp9vAnbS
- TLSH T128621959A7DC862BE8BF0F7E887617040B72B4259912EF1E0DD5708F6A733404B11BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\aaron\source\repos\Mei Mei Virus\Mei Mei Virus\obj\Debug\net8.0-windows\Mei Mei Virus.pdb
mscoree
_CorExeMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net8.0-windows/Mei Mei Virus.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 54e1d39b694b5ffb086042f0fc0d8e1bc415fba3aa80600be41e82214ebb5dad
- MD5 26f50ac20674cbeaf1ed393d5713433c
- SHA1 3e4f80e26380d4ccda3ace12c4500efa5e3c3526
- SHA512 f57eb4244accdbfd4fbcf091dcf82eadf2a380aa1207baf7d0b9e4e4b84c52c436e5f852e0ef08ba2ecdf3b9f2473f390a3cb5a300054631507eed666f9af927
- SSDEEP 3072:gqeXA/4yIg9vkNPNu6H6xCYOiEUE265jJy:gvgvkNFNaxm0EDJ
- TLSH T174E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
net8.0-windows/Mei Mei Virus.pdb
- SHA256 f340970d47f40368696f36e7393a26196130da632aefa54a724e833b9a2611c3
- MD5 d7380cdfed3d19b505d277b36cb3713d
- SHA1 7a98db08dc290e40b65008e1c5248c233c86726f
- SHA512 2852f4fac819b321254ef9d126c85a87caac0b340808e722de05434c34bdd307965fa48a515f62543e7d85235c7c64ec69d9f6c3b1fb3b5e3e7f96bc9aa4bd0c
- SSDEEP 384:oAPvCjtCF4+1jKaw+j/Eys1FwYEy7KDG7HjiucVtLwKRAdHXVfaqZrJyPtkplNhE:baBeSiy7SouxZwitkfTI
- TLSH T15762A2379749DA61C1421A774932C28C7B3483212786EFB9F2D42A29DDAF7C903F6275
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/Mei Mei Virus.runtimeconfig.json
- SHA256 7e79af92820e50910b90f1cade2728f45987393f24b50e384dc225d9773b7194
- MD5 9db099f143ead47e224653d0dde19fe9
- SHA1 d050db767fc64aa1705353132da3e35048475d3c
- SHA512 579c3c870903b3d47dbc2567153fa7c73e0aa47387c6969b8982037884033a4b25de702e0efb8c7ae717b6b463192b917b18a79b1ef5f8c969f257422af2b65f
- TLSH T1EEF0222ACA100DA308B977BEC626D182FE30436B00141966B5FC041C2FB3AA21100F89
- MD5 SHA1 SHA512 TLSH