virus Collectionby-771-groupi.zip
- SHA256 34a8f835f5a0bef2d5dd5cf5fda5000d228b172ddacfb22e7035c2490a12c4aa
Password
771
Overview
overview
8Static
static
3MasonChess.exe
windows10-2004-x64
7MasonChess.exe
windows11-ltsc_2024-x64
7MasonExln9.exe
windows10-2004-x64
MasonExln9.exe
windows11-ltsc_2024-x64
MatrixVirus.exe
windows10-2004-x64
7MatrixVirus.exe
windows11-ltsc_2024-x64
7PEEKABOO.exe
windows10-2004-x64
PEEKABOO.exe
windows11-ltsc_2024-x64
Smil.exe
windows10-2004-x64
Smil.exe
windows11-ltsc_2024-x64
Squidward.exe
windows10-2004-x64
Squidward.exe
windows11-ltsc_2024-x64
7Stalin.exe
windows10-2004-x64
6Stalin.exe
windows11-ltsc_2024-x64
6Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MasonChess.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
MasonChess.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
MasonExln9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
MasonExln9.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
MatrixVirus.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
MatrixVirus.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
PEEKABOO.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral8
Sample
PEEKABOO.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
Smil.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral10
Sample
Smil.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Squidward.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
Squidward.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral13
Sample
Stalin.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Stalin.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target virus Collectionby-771-groupi.zip
- Size 1.9MB
- Sample261024-c2gvjsfs8z
- SHA256 34a8f835f5a0bef2d5dd5cf5fda5000d228b172ddacfb22e7035c2490a12c4aa
- MD5 4422a422ddafe0c9a869f7e53a7f125c
- SHA1 6025d991ea34b255dad1499adf93ec0e46e8d94f
- SHA512 2ada0ca41c0f38a70d8112f54a46d0c9bbb737024df43d3aa75f0b92ca3d4728625954efbf54794e0139615b9bdd0893ec0ec951b993e01db6fe6eba227cd3bf
- SSDEEP 49152:+WwVPslM4l4YH6AEVVyyo/QodE9AMnDO1q/yWou:aSlbMVhoYodIAiq1q/R
- TLSH T1A695339EF852B47C5D0F7F91C23C6A46BD42A5904C0C946857CF1B8EE2AB29B8F716C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/MasonChess.exe unpack001/MasonExln9.exe unpack001/MatrixVirus.exe unpack001/PEEKABOO.COM unpack001/Smil.exe unpack001/Squidward.exe unpack001/Stalin.exe
File Explorer
-
virus Collectionby-771-groupi.zip.zip 1.9MB
-
MasonChess.exe.exe 1.3MB
-
MasonExln9.exe.exe 77KB
-
MatrixVirus.exe.exe 14KB
-
PEEKABOO.COM.exe 921KB
-
Smil.exe.exe 365KB
-
Squidward.exe.exe 535KB
-
Stalin.exe.exe 30KB
MasonChess.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9be0c047cea06ab24bdb1711ca7d4608e179826d079206ed36a1aea830cc5149
- MD5 10956f1eceb4c919805661a5bf59bbe9
- SHA1 51bda4e573711789db96a1755563246e39623af3
- SHA512 001b6eb588a6ac9d41abfe1a7fe001734fc9edb9db0502564532e029f1c30bf317261f63634527deb37ea9e1bb064818c57ec0a94194b23e4a6159039b02514d
- SSDEEP 24576:gfCzYx3PgYWwocek/r2+AAYNh3tBULAkS7LeS:gfCkoA/qhlL3rmzS7
- TLSH T1A455C622A687D993C40E1270DDD7D32977B2E0B46B368B87BA4C9BEF7D213A11CC5146
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
1345930
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Administrator\Desktop\MasonRouletteV2\MasonRouletteV2\obj\Release\MasonChess.pdb
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MasonExln9.exe
- IMPHASH 9442b6fa045237488f87bce426d95b06
- SHA256 622cce1035f8cdb86e362c430557e5c30f39a27bc53f7ccf201f51ba1bb3a965
- MD5 c30245645d088e11e6b57851f0e3b5c5
- SHA1 95853546db82c20be611714eaec91ab6a1e32bde
- SHA512 9979c6f19c7d48abc8eba634d5c4eb923b4c4c22882c78e6e7d77e633da8bbf1913a78ee02d4fcf64fb4a744c862d14b9c8ff08f23165187516c31b6d241f009
- SSDEEP 1536:14onCorR67Q3SaRO7IPqi/rhxdhsCJjmGasWhQcdQk/hO2o:v/RsQRIMPqizhxUqreRQk/hXo
- TLSH T1A0734B43B5D29CB2E5B21D311871CAA19A2FB9210E248E6B7794137E5F340D0AE35FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
1
Major OS version
5
Entry point
5558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Owner\source\repos\StringMbrBuilder\mbr\overwrite\Release\overwrite.pdb
kernel32
ReadFile
GetModuleFileNameA
WriteFile
SetFilePointer
CreateFileW
GetModuleHandleA
Sleep
CreateFileA
CloseHandle
LoadLibraryW
GetProcAddress
GetFileSize
ExitProcess
FreeLibrary
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetACP
HeapAlloc
HeapFree
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetStdHandle
GetFileType
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
DecodePointer
user32
ExitWindowsEx
MessageBoxW
Name
.text
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=122, id=243, version=40116,
count=24, id=242, version=40116,
count=36, id=261, version=26706,
count=17, id=260, version=26706,
count=18, id=259, version=26706,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=93, id=1, productName=Unmarked objects,
count=1, id=264, version=27049,
count=1, id=255, version=27049,
count=1, id=258, version=27049,
MatrixVirus.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5906dc7c3cd938b874cfb12cd9a14a6e72116c31385f4584f997f1544e3da492
- MD5 13e1f4bc5b116e4ec87f055715563193
- SHA1 9eea7e9fce555b6c35730ec3dba29a13921f53f1
- SHA512 a53f446a2063684e401ad8c7da70ea7be4d23a2043341d9ab280dd36a1e91ef43b11ff510405125b957d88f5d9c7c00edb35977d8fe512e6fd0236f6447a030f
- SSDEEP 384:PX//sbBzFbtTLqr/tS2Ab9FhV0beOrptYcFwVc03K:PXCbgSn1IeAtYcFwVc6K
- TLSH T143620A4AE7944275D5BA027319B3A745CB32E22B8D47DB6A3CCCA05E7FA32064733395
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
16918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\MatrixVirus\MatrixVirus\obj\Debug\MatrixVirus.pdb
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PEEKABOO.COM
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
- MD5 d0ae6aea701de9f127f91e7efdb50252
- SHA1 cb9ef64cbcb999372fb4046e99fe89a03df9bc81
- SHA512 505d11808e9923ff0ec1a51acd51509711f8c5c42da81b47a97249954b06f6f45ddda4655446daeb7f231785cd484ebc6e9ada92b857ad3a8d7ce04276536f13
- SSDEEP 24576:lCFZOZHLhrN+f4SULfWyBPzB8JAk4cQATb:oF+LL+fIWybB8
- TLSH T15915339832772A1FC8E73B37E5E739A463AE323D1936215C04A5F37D1E415C05726EA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
948526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
918KB
Virtual Size
918KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Smil.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f534bb9d7cc4c0f8abf8adcc592a328a64a902211ab66bafd9a0c7a333e86a20
- MD5 ea210a16c2cd0f7d84d3961bccbfe73a
- SHA1 598a97e9c7aef20ccc65ed04aa9449564b53f48f
- SHA512 baad73a63e0e4c56bea3283f0072ff7682e37afa96403c99e714373ab49b20e990044f6a221a89d27fd8c763af06e7418886880d41cc557be9892daeb3877c65
- SSDEEP 6144:iT+DPxVn9PvkYyeryYpaVexc6dJ1QYsjHf6EnJrNlT9Fb+3jqSd6A5n6n9TCX+Ct:iT+rxV93k4HpaVexd/FuHfFLEjdnC9At
- TLSH T18A84135561BDF193EAF9917318FFA004961A972FA3056BAF1C84D937AF0AF84320791C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
235934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
222KB
Virtual Size
222KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Squidward.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
- MD5 82bf26203c5d76dfa3a591f1cb60d7b5
- SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
- SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
- SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
- TLSH T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
305038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
244KB
Virtual Size
243KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stalin.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4f50bb2cd893f1f225e02f66ecf0765830f078265e81096dbf551589cc641d43
- MD5 65f583c1c4322f11c7f947948d9c70fd
- SHA1 b570e11c47d64af6b00a3b6f362e067144a692ab
- SHA512 da14e6ffc9ebb593f0f5fcf199cfe3db48fb16683ad617fddac27b49e2b911e35fbbde271ab7d82d702b80d3558c6ee25c3759d01dafa8c1229a1efee4f44fe5
- SSDEEP 384:aIyoju/Dgxy0hpT8embLGG/tT2f7VXMeQTj0HeRcQyyyWuptYcFwVc03K:aIFj7XoTi76Jvaem0atYcFwVc6K
- TLSH T14BD2191D6266C027C56832B9EC2796F2817DDD89E455AEA335ECBD0D3F7620780A12EC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
15974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\n3r-\Desktop\Stalin\Stalin\obj\Debug\Stalin.pdb
mscoree
_CorExeMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ