bot1.zip
- SHA256 a8b70a83b72ed1e5558aeaf31fcf804c734e04eddf1b688a88d970824cae516a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bot1/bot1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bot1/bot1.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target bot1.zip
- Size 15.9MB
- Sample261024-p6ebfaby4m
- SHA256 a8b70a83b72ed1e5558aeaf31fcf804c734e04eddf1b688a88d970824cae516a
- MD5 7f4d36439ed47867dee814cf1223d5e1
- SHA1 346995774abc85e5767a4ecc2ed5e3bb57e6d738
- SHA512 8cff4a7dc2b857e97d4aef224aaf89ec5d4e2d396988964bf4ad5667acd945d56ce5a5ab4a2bc4da461213f959d5b8d0ab2c971496d73bb660bc82c076a5701d
- SSDEEP 393216:t0ygF99iD4AFKZRLhfKHXbiij5OnWOOPwR4R:2ygFikpf0XbF5OnWOOP2m
- TLSH T1E4F633C4EF050CF597E261DF4D3246F47285A8E5B23AB758A9ACB33D11E10E25847E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bot1/bot1.exe
File Explorer
-
bot1.zip.zip 15.9MB
-
bot1/Kh.json467B
-
bot1/bot1.exe.exe 16.0MB
bot1/Kh.json
- SHA256 0059a045dfce920d121796552d96824d70c4f9f488ece386601ae06d8c7d17a3
- MD5 b45b260ad8ac98bf2bd18e45e4ade5e4
- SHA1 eb3f8f5caa61eca98981e7ca3655fd3bade90057
- SHA512 b0b4c5700ca8c90ea1bc414d0528ee26384a176f13e2cc593659abf5eb277e5c199fc12a390d99ef5673fade7ab65ea479d3c1cb6a4cf875f55552a903ad248d
- TLSH T1BCF0A7E196247D16067854E850DC30817F12014FA685986EF6AC482E4BBCA32E0D4DC8
- MD5 SHA1 SHA512 TLSH
bot1/bot1.exe
- IMPHASH 20bd67bca6c560d47ee260a75029b116
- SHA256 fd06230e4a28a78f64cdfc4fd12f572c9aabd21ba81e999765bb5091b80b24bf
- MD5 f71d02804251627f1ceaef8170e89e93
- SHA1 45b952bd66aea2eefebfd985ae082bb91ecc6020
- SHA512 92a1309b1a1c9bbe1ea4629b5e2139877630797a10f66d1071e3a0e0736c21dd9a4e1fece0c82886f28ab5556882a06852c796f7e781f2b3eab880561396f346
- SSDEEP 393216:cQM+rCRGrkWxwhD/V/EsfuhWj1GHKYK82Irc:/M+qGa7/9fuM1GHKYKtW
- TLSH T12CF633A4EB1318FCC3D371FA897245F13525BCB55235766E62ACB23833A38E1184BB59
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4389
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddDllDirectory
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateProcessW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FindResourceA
FormatMessageA
FreeLibrary
GenerateConsoleCtrlEvent
GetCommandLineW
GetCurrentProcessId
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
GetProcessId
GetShortPathNameW
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathW
InitializeCriticalSection
IsDBCSLeadByteEx
K32GetModuleFileNameExW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadResource
LockResource
MapViewOfFile
MultiByteToWideChar
OpenProcess
ReadFile
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wargv
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_unlock
_wcsdup
_wcsicmp
_wrename
abort
calloc
exit
fwprintf
fprintf
fputc
fputwc
free
fwrite
iswctype
localeconv
malloc
mbstowcs
memcpy
memmove
memset
puts
signal
strerror
strlen
strncmp
vfprintf
wcschr
wcscmp
wcslen
wcsncmp
wcstoul
shell32
CommandLineToArgvW
SHFileOperationW
SHGetFolderPathW
Name
.text
Size
125KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
15.8MB
Virtual Size
15.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ