skeet.zip
- SHA256 4a4f2131aeaabacbb6675b4a947532ab09a9dd1702dd86b2c2c1e8e66bf3c326
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cfg + skeet/skeet.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
cfg + skeet/skeet.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target skeet.zip
- Size 2.8MB
- Sample261023-yl7xpazwez
- SHA256 4a4f2131aeaabacbb6675b4a947532ab09a9dd1702dd86b2c2c1e8e66bf3c326
- MD5 db2bde91473ca04bd762b9231f7d7031
- SHA1 3efedd14ff2a485695f2697b20273fc5d4c34000
- SHA512 817f34fe6d4b2e14a41a0aa0f808bbdfaaa5e47d157306c28a74401d03df964b3d05e070b37cc73260c59bda00046831e4cdf4377c0d71e932200d3a74fe4dd1
- SSDEEP 49152:XrHBCRCGFuFyTvEmRMXfIySYUx/Gblsb7KrwQI3t+P0U6agDNzxe0EXzbq4YRUd:XrhCRCvywmRSgGOGbub7MO3sqVz8HXzX
- TLSH T149D5334AA1270DDDA4CFD27A901B97C87756B8280930C2D78582DAFCBDA365D79CF270
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cfg + skeet/skeet.exe
File Explorer
-
skeet.zip.zip 2.8MB
-
cfg + skeet/skeet.exe.exe 6.0MB
-
cfg + skeet/skeet/SLOT 1.cfg7KB
-
cfg + skeet/skeet/SLOT 2.cfg7KB
-
cfg + skeet/skeet/SLOT 3.cfg7KB
-
cfg + skeet/skeet/SLOT 4.cfg6KB
-
cfg + skeet/skeet/SLOT 5.cfg6KB
-
cfg + skeet/skeet/SLOT 6.cfg6KB
-
cfg + skeet/Инструкция.txt3KB
cfg + skeet/skeet.exe
- IMPHASH b6d098368046cdc84a6be5238a325619
- SHA256 5325b18de24aee0a93da14f4033a6f65ffb6ba4d9ed98d5e6e25f5b0afad78d9
- MD5 531eae6efe99e7a256dd1244f36e321a
- SHA1 716f8f034d0bf684fe663993ac613b23c5753e18
- SHA512 9f608a2a796f208bacbc4462184d0616d8b294b85572504447849eb6cb4a3d222bbf7f778a52dcdb6da0f7d191587e33eb94eb9659d0a7565995af86f3fc6bb9
- SSDEEP 98304:CeAKYiOp9nvIT85zNcxnu4H8uBXwLi83j/78:RAKbOA8HehTwLJz/g
- TLSH T15156AE07F78151EDD02BD57886A7632BE231B4460B3157DB13846A396EA37E01F3AB93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
911248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\skeet\loader\..\bin\Ship\skeet.pdb
shell32
SHGetFolderPathW
ShellExecuteW
kernel32
AcquireSRWLockExclusive
CloseHandle
CloseThreadpoolTimer
CloseThreadpoolWait
CompareStringOrdinal
CompareStringW
CreateDirectoryW
CreateEventExW
CreateFileMappingW
CreateFileW
CreateMutexW
CreateRemoteThread
CreateSemaphoreExW
CreateSymbolicLinkW
CreateThread
CreateThreadpoolTimer
CreateThreadpoolWait
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FindResourceW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushInstructionCache
FlushProcessWriteBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
FreeLibraryWhenCallbackReturns
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetExitCodeThread
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoEx
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessMitigationPolicy
GetProcessTimes
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount64
GetTimeFormatW
GetUserDefaultLCID
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitOnceExecuteOnce
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsThreadAFiber
IsValidCodePage
IsValidLocale
IsWow64Process2
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
Module32FirstW
Module32NextW
MultiByteToWideChar
OpenProcess
OutputDebugStringW
Process32FirstW
Process32NextW
ProcessIdToSessionId
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
ReleaseMutex
ReleaseSRWLockExclusive
RemoveDirectoryW
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetEnvironmentVariableW
SetFileInformationByHandle
SetFilePointerEx
SetLastError
SetStdHandle
SetThreadpoolTimer
SetThreadpoolWait
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableSRW
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAllocEx
VirtualFreeEx
VirtualProtect
VirtualProtectEx
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitForThreadpoolTimerCallbacks
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteProcessMemory
advapi32
AdjustTokenPrivileges
CopySid
EqualSid
GetLengthSid
GetNamedSecurityInfoW
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
LookupPrivilegeValueW
OpenProcessToken
RegGetValueW
SetEntriesInAclW
SetNamedSecurityInfoW
user32
AdjustWindowRectEx
BringWindowToTop
ClientToScreen
CloseClipboard
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
EmptyClipboard
EnumDisplayMonitors
EnumWindows
GetCapture
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetMonitorInfoA
GetWindowLongW
GetWindowTextW
GetWindowThreadProcessId
IsChild
IsIconic
IsWindowVisible
LoadCursorA
MessageBoxW
MonitorFromWindow
OpenClipboard
PeekMessageA
RegisterClassExA
ReleaseCapture
ReleaseDC
ScreenToClient
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetLayeredWindowAttributes
SetProcessDPIAware
SetWindowLongA
SetWindowLongW
SetWindowPos
SetWindowTextW
ShowWindow
TranslateMessage
UnregisterClassA
UpdateWindow
WindowFromPoint
ole32
CLSIDFromString
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromGUID2
d3d9
Direct3DCreate9
gdi32
CreateRectRgn
DeleteObject
GetDeviceCaps
dwmapi
DwmEnableBlurBehindWindow
DwmGetColorizationColor
DwmIsCompositionEnabled
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
293KB
Virtual Size
293KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
453KB
Virtual Size
481KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.retplne
Size
512B
Virtual Size
200B
Characteristics
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_guard_c
Size
512B
Virtual Size
36B
Characteristics
Name
_guard_d
Size
512B
Virtual Size
36B
Characteristics
Name
memcpy_
Size
512B
Virtual Size
264B
Characteristics
Name
.rsrc
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
cfg + skeet/skeet/SLOT 1.cfg
- SHA256 37b3cd0b99eae369173dd3c87e416fecb847d65c1e93838be03ea626854412d4
- MD5 311df0cc5a19b5c210be56200a8580e9
- SHA1 bce4cd1dc8c5d5d8579a3f863ed4c89899291d6c
- SHA512 6638202bbaa8b4c9c95c476c506204dfafe6b90e6a98055fc9bba279ced145330cc0d476e717894b56e2c16af584fde6a9eb4646687198e999c645007e06201c
- SSDEEP 192:y2MnuoWCgOdfs+9eIKR2Miz585nTHHPyY0H8kbX:H5CgOdfAFRy5iHPrU7
- TLSH T1F6F19EADCF89618C3D7E07EC09C3ADE8B03EE0D65785C5D7A692215D4882867F9D802D
- MD5 SHA1 SHA512 SSDEEP TLSH
cfg + skeet/skeet/SLOT 2.cfg
- SHA256 154806e6ff21cd7ce14375489276add2ac19547d16061e5b047c8334e71845d7
- MD5 8f2f42e9ba9d53b499d37d3bfed765a0
- SHA1 04dc6864e2bcaccc60e8e1f3bab69b16298af717
- SHA512 e634e544408034487eece8388ab9d797c08ff446d1e65bd8d7f2557b6af14643eaa6f5300bfc71fe3e43c11cbefa4c8a1c5f3268e797102ceb3ce663a961870c
- SSDEEP 192:q2F+qIm7wCfyxUqxOyHpajf2rVfXMms42O8wz/Sk9HCX:P7keyaOwf2JD2Olc
- TLSH T1E1E19D6CFA4592EC197E1F4D44A3BEFCB0AED41142ABF5C61A51A08AC8438773393C09
- MD5 SHA1 SHA512 SSDEEP TLSH
cfg + skeet/skeet/SLOT 3.cfg
- SHA256 15ac21193fed09c412870417151129a3e60720f47d4d34e95d805299e5b27168
- MD5 fa5e9d5b1f1ca40af0ab03fadffc701b
- SHA1 8d109557dcd40e2a6dc10c671fb0fe19a75e8096
- SHA512 d557d7389ae2b11d20fe8757590e059e8cefdee5dd4513980f1530cce5a6320aa96720afdfd10fa7a217baeec1849cbea167b0d9a9f386de62bd20e21a75ebc9
- SSDEEP 192:62TYDHmsfzNHawitI7VUF3H7X0v7n3TtZIg3KHrEVPtO:/DkNHa3tIyLkj3PTIEVPw
- TLSH T1EBE19E7CF84432E0291B636804D7ECE0E49EB092A6F5F5CABA967059CCD313BE31449A
- MD5 SHA1 SHA512 SSDEEP TLSH
cfg + skeet/skeet/SLOT 4.cfg
- SHA256 51104331175cefee818e05719f1bf496df36d3dfb8fd51744be8e19bb5484817
- MD5 affe10c76464393176919922dbc52e32
- SHA1 191fb564e7e2ebb15ad42813805345477b938b98
- SHA512 ef06fb05ee628d62844f64dbc8abab3fff3fd0577e7eea3213966b608cd297533f706669601d4648f34abd42ebcc05026a86bd5313bab1a99b33d4dbc44628e9
- SSDEEP 192:M2kZfdtz8fs4QPbJ779PAZ7oz+hI1vbmF5AzkFGj:NkVdN8fs4QPV77OBoz+hI1aOkQj
- TLSH T15FE1AFBC9F8763203E6A67144AD7DEE8F04DE06BD7D13985A696B5888881D336203069
- MD5 SHA1 SHA512 SSDEEP TLSH
cfg + skeet/skeet/SLOT 5.cfg
- SHA256 40ba40a3734dbc382e38571abd76ad3d34f11946301714fc6d4d9232ba6c1cee
- MD5 5af8e44c719098cc8bc1e8a96e6b8a00
- SHA1 dcd23d7ec88bfbfceec122f594669a03cccb7d38
- SHA512 0ed2bd6b13de83e3f389c4994882f732d0e4f62a9294d6d8c6580e5fe62a50beba6544137eee0555ceb7623bbb90c8174c12b69c421fc8256fd72b13f05e3adc
- SSDEEP 192:+2hwdtzDWhtG9ZDt/GHHtl267Q6AKS9cQ407PzDOCtD:jhwdNKhtG9FtOxQCS9z7tB
- TLSH T13FE1AEBCBE91D1DC2E3D4755C4D6EFD8F0ACB016E98DBE58EC87745108A7C27A202118
- MD5 SHA1 SHA512 SSDEEP TLSH
cfg + skeet/skeet/SLOT 6.cfg
- SHA256 bec30aab51d88c3ddcf8567cf26ac9aa04af5eae187422455b93ee209b89e0f2
- MD5 9d1a709af5f165876b3f263dffc73c5b
- SHA1 2a5201189901f4b180e35197078c3981b84326c3
- SHA512 9976656c4e624788ae932ae8b387ec390218678046e890ba4bbb42c77e9dadf4fe654ae3a83f5d678cb1e8596d9920a9097ca3d917c3883150610d814df0d5f5
- SSDEEP 192:X2JoLFhFDDjjNrFoNg08bNwL0Y+m+2Xp8joio:GJoRhFDDjj1Foi0cc0YB+2ZaO
- TLSH T155E19E7DDF4623C83FA663A0A4878DEC70E5B056B08AF4BD5BD661A44C83E3B710191B
- MD5 SHA1 SHA512 SSDEEP TLSH
cfg + skeet/Инструкция.txt
- SHA256 106d8837f9216b5e0d73f74e8f7202dfa8d38fb0365f8f048e6f3992231139d0
- MD5 f5842024ca032aaad0266612ea78c157
- SHA1 65f0046d3202eac9637c507fe3d81e1924ec873e
- SHA512 9d131ee1fa63d685e9c743bca4fb77306de3f2947cf653ac06b6022d944a21d46d5a4812c2c04ddc29ba5abb74d04ce73d9de20b1ad49c374096444278ab2676
- TLSH T17161F5329199639A4108AD579870FD087B9A04FEBF7A5616F0D05CED3CB24348F296E9
- MD5 SHA1 SHA512 TLSH