PhotoMap.zip
- SHA256 d66f6d385b4037037679075a24b018fb9112aeab506c62f34b1d6fbae4e99ca9
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PhotoMap/ExifLib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
PhotoMap/ExifLib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
PhotoMap/PhotoMap.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
PhotoMap/PhotoMap.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target PhotoMap.zip
- Size 29KB
- Sample261026-3vb9laas2m
- SHA256 d66f6d385b4037037679075a24b018fb9112aeab506c62f34b1d6fbae4e99ca9
- MD5 96f89aec2ace5134f9525aa41c5e8231
- SHA1 9675ecf02f260d1475802d9da8a32a954b4e1a86
- SHA512 38e25721faa5b528e2bb6dca66ee7f4c2ba377f8ee23f68acb76205f2ee0d8484eb405fc7f7e6bf92b42c34cad133b165cedcce4568545ebcd4ad7e49fc4cdac
- SSDEEP 768:kAX2INMLSyGaP3H2eLQwSsoNHVmsCHKqUxjGarHC/8Ahz74UhnJt:N2ImSyGg3H2vw/oN1EHKqUsarH2z0UZ
- TLSH T188D2F1E8EB47E509C04E71B16A0769F41D1A6F491432E6FEB4EA1F4C5C36F8D25809C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/PhotoMap/ExifLib.dll unpack001/PhotoMap/PhotoMap.exe
File Explorer
-
PhotoMap.zip.zip 29KB
-
PhotoMap/ExifLib.dll.dll 28KB
-
PhotoMap/PhotoMap.exe.exe 24KB
PhotoMap/ExifLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cb39e99f3b58e9c2e05f1530f31b8c7a3255f1406e998ae8c89417ab44313ed6
- MD5 3c46832812f0f62390371c5cbc707a92
- SHA1 08daaff0e0043a89270f6b9388b37a000bf262f7
- SHA512 93a21109659349cb4999560c191263d8f8423cfc059072a518b76985c64a7ceac780854c9bfdb40944fa5b06b1c093ba077f791dade89f419bd733e94d7a43cf
- SSDEEP 384:hy0Tz8a4VJkfi/f/sqi7DxYcMtYHO7hbL:Y0EdQ6/hi71YcMWHO7hv
- TLSH T1A4D21A0C47BB0723CBFB967DCCA118854A7857015FA2C7BB968D45C9EC267A0D66338B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
PhotoMap/PhotoMap.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 726705773a3cf48478696815884dc54ecc7742bb4cd72bafdb436e8922f8cff2
- MD5 5cc657a24ea8c5b6d25c42e70bbcb82f
- SHA1 f5d498a1ad81e8085f6e533d8f2173b4879d745b
- SHA512 e1a6d509e9db8e15c8966901c136a8f5d6a8c3b4c4f1b96d7c4bdccf7c2ef83e63a1d90bc2ddcb0e1458110eb55420891dd324c717024ed61de3155c03a562fb
- SSDEEP 384:L8yvT4jCowx85+bWQMTUdBZG155oMC3w8Vj7cM33ld/ziN:gPjmx8Ub3MQk5PCgKD3/zq
- TLSH T163B2BF5693F96B72EA330674BA170B815339EA46CE03DFEF04D967067E02FC945E1A41
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\CCodePrjcts\PhotoMap\obj\Release\PhotoMap.pdb
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ