morrowind12_bh.zip
- SHA256 a6bce50da1e79465ae874882ece994f97a5d606330a26475cdb06fc88a0ee768
Behavioral task
behavioral1
Sample
patch12.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target morrowind12_bh.zip
- Size 9KB
- Sample261024-x36khsff39
- SHA256 a6bce50da1e79465ae874882ece994f97a5d606330a26475cdb06fc88a0ee768
- MD5 b6c69a4f06218b71ea9e90f9877b2da3
- SHA1 4d3906bc166b70d9c6de46ac896cecec3026728c
- SHA512 8d493bc57d6cd051c01615c0afdab14ae0512c74062b30909e087ec72be2a4cc1a9442b97d83a70638c12b2b85ef839b51758dab88252ada4edaa7ad178ef7cd
- SSDEEP 192:vR8gICh/9G/XalKO38hnV8iJtAli4bE9YMReF154kYLOaEc5:vR8BCivhCiJttx9YH54fLxEE
- TLSH T119128EAF20E9D313AC318E725E5AFB55052FCF4E8A92790481A98CE03E4645CCFA9425
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/patch12.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/patch12.exe unpack002/out.upx
File Explorer
-
morrowind12_bh.zip.zip 9KB
-
EVOcRk.NfO3KB
-
FILE_ID.DIZ705B
-
patch12.exe.exe 10KB
-
out.upx.exe 14KB
EVOcRk.NfO
- SHA256 d81366b4adb32576a1a80d8e6169252784668fe87878509ecc997899699b7b9c
- MD5 eb8569776dc6291bdca300ec0df79367
- SHA1 11119809cf395602bd184f27990fc2a39f74a95f
- SHA512 fc6ba77e7b6880634680097da2ead16ba8ad2ae8093e0924b9794734f29ec5ff238a029fea15aaaa89174a254c7e0a6f3e4b9255d5e6c59333f582066b67fca0
- TLSH T14771C7F6E5AEEEA48078036653A52FA4DD025E5FC0697CCFF82C104A1778A6D93F2047
- MD5 SHA1 SHA512 TLSH
FILE_ID.DIZ
- SHA256 96eaaca6b4fef9c9e2dad747bd2899450116d221101365ca036ae96359ebd551
- MD5 1e65f0044be7f5478681bf538ea42974
- SHA1 47c1b0f8e831b1f6bddee8f1d5d6353e3e5d37ac
- SHA512 af3795634f1bba712293f4cc9951b5766595e77fc24997ec8c4e01df4652bc2bdabd8383dee21524f77ae267e63ded61d649a91a78a51eeb72166f469b2dbf7c
- TLSH T1E4011C69DD2ABE0D0036F5765AA7D3DDC604200EE76926A4312FB712036F7B6431ED31
- MD5 SHA1 SHA512 TLSH
patch12.exe
- SHA256 208fda91495f1ecafa9b881b0860c75a5995602b2eab8c8f5d1a0ae446630c84
- MD5 c74730fc9a6824cfbec297b2278dd7a4
- SHA1 5f251ac9b661dbc003a0fe113555def402d04dbe
- SHA512 ef6063436e86aff6af1fa3d153c4a6e6bababe318f2e4aaa5d78dac14ccf4a0ab0aab450e7f3b6daa17201a1f42ff92cd47948d7572fd180f1ccb38f9bef3a08
- SSDEEP 192:4szy2bnHRffm0hUK8w37P6/4gSm5eNEoVUMuR/Cq/f:3fHRhUK8wLP6rJZiruR/3/f
- TLSH T196227D52F2248FDAD41C2235215FE2847053EC801F99A37A2376B49F9DFFA961C9ED01
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35584
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
7KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=24, productName=Unmarked objects (old),
count=1, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
out.upx
- SHA256 c70c0a23b387488b678d5be58c20309e3d67e146b7b5190fa18d138010615eaf
- MD5 fa5787da2b3f94cf8586639b7125e944
- SHA1 d653e3c63b895f426d60724d127aa24824d48c5a
- SHA512 e90313188e2008efd5d71dd81dcd1d7ad8b2484420c5fcd2d430ac7d511abd9c0d2354e0a4f202333c38305716ad59da081f952e3044205100c2818b89dce4cf
- SSDEEP 192:lFNi2q/fchsCn86wx0sh930oFZ057WESMd3Qi6rJ58X:lFN0/fIT8P6shJ5b077QiiJ58X
- TLSH T109526DA1D2A98647E46C187514779A808D13FDF069683A29FF26B87D6C3E230EDA513C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
554B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=24, productName=Unmarked objects (old),
count=1, id=18, version=8444,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,