Proton Drive Download - 2026-10-23.zip
- SHA256 0320a2d605e356e024acd73311a6e22036007a9c2654afb28656abe5024b753d
Behavioral task
behavioral1
Sample
Proton Drive Download - 2026-10-23.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target Proton Drive Download - 2026-10-23.zip
- Size 5.7MB
- Sample261023-nd3mwsdv4p
- SHA256 0320a2d605e356e024acd73311a6e22036007a9c2654afb28656abe5024b753d
- MD5 3b588e5774e29a19a93689e3b88316c6
- SHA1 446115c1fbc6d7343dd91cc12759cbfca42029b5
- SHA512 bf1f674b283982fda405c2f98303deafb78335fc9a9dab187246a1ba33ef696448151daf0aabc4f5eadb873ee55930b37f3cdb8d097f677497a032bcc717e44d
- SSDEEP 98304:ROo4+8OjBb/Mw/zM76IEeKilLyUb3wAGiGupuQflJbj+8Fc4sOZor8dopq3Wu/n/:gY/9MAeJ73bCusQfru8FOXcjmuPQTznW
- TLSH T13F5612107591D071E572813336BADBB1197DB9304B1228DBB7C81FAEAE602CE7A35B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/nssdbm3.lib pyinstaller - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Malwarebytes Keygen By IIIOH#3837.exe unpack001/Qt5Core.bin unpack001/nssdbm3.lib unpack001/vccorlib140.dll
File Explorer
-
Proton Drive Download - 2026-10-23.zip.zip 5.7MB
-
Malwarebytes Keygen By IIIOH#3837.exe.exe 276KB
-
Qt5Core.bin.exe 446KB
-
nssdbm3.lib.exe 4.7MB
-
Malware.pyc2KB
-
vccorlib140.dll.exe 300KB
Malwarebytes Keygen By IIIOH#3837.exe
- IMPHASH 953ddbeaf8260a562016edb32b006967
- SHA256 df8244a8d8b8f979b5e221c9ab247a8dd72876317be903de80ac02079152ce36
- MD5 d59223a436ff1c8b6923b816fd1f3d77
- SHA1 8e5ca6f88ea22e0d082083f7e5edd803cf8d4a80
- SHA512 3213ccad1a288416e6a3fe01a65ed9faaeff896c640806d5d348942e67e0ec84bbf3384680d54d36db6b7df1f8d7a933bf63ce584f55a511c3e16be6e6c8a3de
- SSDEEP 6144:U/iUjZrwnsbcvjClducFnDq8zOgyVrB7qTixwYBD086QXhaasQuPVZ7o:8Fcn/JcFnD5IOixnDd6S7sQoVZ7o
- TLSH T16A54AE1175908471D872157605F4EBB1AB3DBD304FA689CB67D40F7FAF302C2AA35A2A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
58037
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
MultiByteToWideChar
LoadLibraryExA
CreateFileW
CloseHandle
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
HeapFree
GetFileType
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
SetFilePointerEx
HeapSize
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
version
VerQueryValueW
Name
.text
Size
158KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=160, id=261, version=30795,
count=18, id=260, version=33218,
count=21, id=259, version=33218,
count=78, id=261, version=33218,
count=23, id=260, version=30795,
count=1, id=262, version=30795,
count=5, id=257, version=30795,
count=90, id=1, productName=Unmarked objects,
count=4, id=265, version=33522,
count=1, id=255, version=33522,
count=1, id=151,
count=1, id=258, version=33522,
Qt5Core.bin
- IMPHASH 5d2ea98cc5ced1fb66dc5f789591a7ed
- SHA256 2a23d76da72eb1da45bb3d2d4072f8fdfac25f21d5de12ebc5c7f50bdc14a695
- MD5 ca29d55d7bebded2c9972374eeee216c
- SHA1 338a907f742468fcbfb02396d8a5690f383d99fd
- SHA512 8c0bb7e01cd31657603485f644bf7c01188670b8568254209573156a4fd7e1dd040a722b9b72812a27632f6b7c343341f371b26cdd96cf5148dfe32a0a6c0383
- SSDEEP 6144:ignVfzt3lAkJ5ASAUVX3BOMkhdGC20CqFODCPUDeTyoPqxlyIZhJO:nLt3lzDxOMgr2woCP9TTU/34
- TLSH T184A42B1475B2D0B1E165C173361BDBB059697434972338EBB7842BA81C606CEBBBBB13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
308444
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryExW
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
HeapReAlloc
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
SetFilePointerEx
HeapSize
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
CloseHandle
WriteConsoleW
Name
.text
Size
384KB
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=161, id=261, version=30795,
count=21, id=260, version=30795,
count=17, id=260, version=32533,
count=22, id=259, version=32533,
count=76, id=261, version=32533,
count=3, id=257, version=30795,
count=88, id=1, productName=Unmarked objects,
count=10, id=265, version=32824,
count=1, id=255, version=32824,
count=1, id=151,
count=1, id=258, version=32824,
nssdbm3.lib
- IMPHASH 4df47bd79d7fe79953651a03293f0e8f
- SHA256 e86255a656d7508dbf09ef79a2a588b11f94f2a9468747202aa9d50d440ec89e
- MD5 a06b11f0dd19ba72a61989e08cde676e
- SHA1 6fcbeaa2edd5874e858a1ced7dc052db32b591a7
- SHA512 5d181ea5813cee52ca80cfe564dc30c27617a9877e3e53215077ba21ebedd150bcb663a528a656525af4efe092fbd5739ae854cb3c93f7f69c8649f25f72014e
- SSDEEP 98304:u/Mw/zM76IEeKilLyUb3wAGiGupuQflJbj+8Fc4sOZor8dopq3Wu/nQTGBVIDCa:Q9MAeJ73bCusQfru8FOXcjmuPQTz
- TLSH T1F63633C5B8C1CC76E4BA123505E1D63525BDB9738712195B6EDD0E2ABFB26C13838C2E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
30986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
HeapReAlloc
SetEndOfFile
RaiseException
ws2_32
ntohl
Name
.text
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=170, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=259, version=24123,
count=29, id=261, version=24123,
count=18, id=260, version=24123,
count=5, id=203, version=65501,
count=113, id=1, productName=Unmarked objects,
count=17, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Malware.pyc
- SHA256 f7d788caf29ed9173992cada253c24cbfb2c621aead65833981854715bd7d261
- MD5 3d53be18c86e977670bc430a7d6c897a
- SHA1 cfa166ee3230eb43a5dc44b045c42fab5f119401
- SHA512 788498c8798dd269054b54f59c4ae3264c9793b6e61ea6de13ad0d83d1ba0976227a8410e5f1ad85feaf9884009dc21aaa87a5ca1782d29c2154a30e96b3839d
- TLSH T10D510E756CF113956EE1A162B07AF89C631617D4BBFC0209F0CC3C85BEBA914B7916C2
- MD5 SHA1 SHA512 TLSH
vccorlib140.dll
- IMPHASH d313ecd002c12a80284c87d3cd0fce06
- SHA256 c687ddc0feab7a72e4a68dd2bb795ad5ad3b4f1175e7987bcafafceff44e970d
- MD5 13098a24a02cdf3c9973de85d29e98c5
- SHA1 07637ade03755e860094d5c174e555b7802fbd63
- SHA512 8271e18987593a4fb8269ee3b8d66afe904a29309e3a585375d819a4ca980b46ed9d11b6856e9edf8d6de95e1f6a6d8639fbf5b4cddbecd6f06fff136308fb28
- SSDEEP 6144:q0M13u/abFV5X55WxbtOj4rG4//ng0eqqt7T/hWV:q0MJuihV5XexbtOj4rR/eb/hq
- TLSH T109644B20B242E036F9A34472AFFDCAA9552CB9300F5614D7B3C85FEEDE645D5A63070A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
148149
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
MultiByteToWideChar
CreateFileW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CloseHandle
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
WideCharToMultiByte
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetStringTypeW
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
RtlUnwind
GetModuleFileNameW
LoadLibraryExW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
WriteFile
HeapReAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
WriteConsoleW
winhttp
WinHttpReceiveResponse
Name
.text
Size
235KB
Virtual Size
234KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=166, id=261, version=30795,
count=21, id=260, version=30795,
count=17, id=260, version=32533,
count=21, id=259, version=32533,
count=87, id=261, version=32533,
count=5, id=257, version=30795,
count=134, id=1, productName=Unmarked objects,
count=4, id=261, version=32824,
count=1, id=255, version=32824,
count=1, id=151,
count=1, id=258, version=32824,