Nums2Words.zip
- SHA256 75f533297370e0425680df718981b711653956269ec5ae1369b5aff57603c750
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nums to Arabic words.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nums to Arabic words.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Nums to Arabic words.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Nums to Arabic words.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Nums2Words.zip
- Size 103KB
- Sample261027-dascms1sgw
- SHA256 75f533297370e0425680df718981b711653956269ec5ae1369b5aff57603c750
- MD5 d92996d91789b8346aae79ff99050657
- SHA1 8c0b48d0dcf0072f40aafecc9b49df2dc1f82b17
- SHA512 65bbb982cf803731ea99e29d2e33be00c55a0a13fa64d70263e647988f939706e46a17ad58b7e6f04ea8bb3e6f5ed32e707aef1f3f01f8226301b965bb9e3df5
- SSDEEP 3072:+xS0jPPCsqxP3fBDP2OM2+NKHTfA9mExt4Sc:+x/Q/fBDPQ2GKHcR4F
- TLSH T169A312A7F590F6AAC7CD68F6194F101F87435D1E4834CAEDA851ED137CC944D3E80A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nums to Arabic words.dll unpack001/Nums to Arabic words.exe
File Explorer
-
Nums2Words.zip.zip 103KB
-
Nums to Arabic words.deps.json452B
-
Nums to Arabic words.dll.exe 49KB
-
Nums to Arabic words.dll.config1KB
-
Nums to Arabic words.exe.exe 150KB
-
Nums to Arabic words.pdb16KB
-
Nums to Arabic words.runtimeconfig.json372B
Nums to Arabic words.deps.json
- SHA256 1962e2c3a61db7447a00d95398efdb922845d885b494d3603ecd91e505f18c7f
- MD5 ef0f17d2ee44c8d76ac5fe6ac3fcdf92
- SHA1 6df23557020833503f7314c2e1a1b5a71e80d366
- SHA512 985b3b0471d57dacad3dcd281a2a91eb6db21a4b330208ad9352d88b33f14212a06184ed9fa0f1d32dc04c8f9573834c652f1dfbf5d0251bd146744ec550dc65
- TLSH T1D1F0ED1EE0848DAB59F133F347368B52F9229A23202428063AFEA00C0F739174010E68
- MD5 SHA1 SHA512 TLSH
Nums to Arabic words.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0a16e57d72763518bd9cd763b6ed34076a443142eb5eeb8d380d564ca74a37fc
- MD5 5bb7b259621d9bfd1f1b42ea3c46e8d7
- SHA1 c5c1aa4f34b7fb8003f8e1ba17624b633ddaf979
- SHA512 32f8980c969b38b6bd6a9fd72a0bf83df3b7404022f188b1598a93bb087502c8ee68189858b2695f84ddb969c81d1d6ecf64596d565cda96be2da3d3630108f2
- SSDEEP 768:NB8NjClIU3+tdLqCNbwiTxG24Hq+gvc5JJc8FQvAUJQ4gAcmlxAnLd2FQvf:NAUIUuNNbRT0hzFkC4gAcmAnLIFkf
- TLSH T1D7337C023754DEABC57E53B58060C13087F6DE816634DB2F2EE88C9B71967518FD2BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
51634
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\hamoo\source\repos\Nums to Arabic words\obj\Release\net6.0-windows\Nums to Arabic words.pdb
mscoree
_CorExeMain
Name
.text
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Nums to Arabic words.dll.config
- SHA256 f9e2acec56b59b77dc8171b395c432a8314fe311b5c94252a01d53141fee8025
- MD5 bd8e32fb5af0b1e4aca835f809fdef86
- SHA1 81e387a6039365d06e012866e154a0222970a448
- SHA512 7eed4cb66e33008f637712aaa7f9af8f694fa13bc88df6a2497c90ca77cda0bc1b65d891752e6212fc582db904c04da82eb9844589c32224ecfce11f3db12deb
- TLSH T173219E46A5D04CB142739663AD544980FF369BDF364D1548F8AEF6AB8F3382C0717197
- MD5 SHA1 SHA512 TLSH
Nums to Arabic words.exe
- IMPHASH 6dbf27f4c70fe2c8ed3e0122ba75d641
- SHA256 423322ca076360d527e824313dfadca41d3d0d3fc85e5fa63af02350dcbaebb9
- MD5 9a6b50bf53570f4f75afe520e6a93647
- SHA1 b95c28e146649e0f43f393cc304168b90c4274dd
- SHA512 d136321a1a8829c13b244a510f65395bf689301ee8d51df551ab602709b3e6162e16fe696de7a2ce70683187eb04b15f0ea2c993624100cf6ba29353ae86eb81
- SSDEEP 3072:dwLEVbLoEZlKk7611VBzNkDqrB5bXEAd9/w3SkE:dRuk7611VBzhZEu43Sk
- TLSH T16BE3280672AD01ECD2A7E27889929A26F3763C16473597CF03D04A7B2F67BD09E79311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
81232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_exit
__p___argc
_initterm_e
_initterm
_get_initial_wide_environment
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_set_app_type
__p___wargv
_seh_filter_exe
_register_onexit_function
_cexit
terminate
_errno
exit
abort
_crt_atexit
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
setvbuf
fflush
_wfopen
__stdio_common_vswprintf
__stdio_common_vfwprintf
_set_fmode
__stdio_common_vsprintf_s
__acrt_iob_func
fputwc
fputws
__p__commode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
calloc
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsdup
strcspn
wcsncmp
toupper
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-locale-l1-1-0
setlocale
___lc_locale_name_func
localeconv
_unlock_locales
_lock_locales
___mb_cur_max_func
_configthreadlocale
__pctype_func
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=30034,
count=10, id=259, version=30034,
count=77, id=261, version=30034,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=27412,
count=162, id=1, productName=Unmarked objects,
count=10, id=265, version=30133,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
Nums to Arabic words.pdb
- SHA256 06ddcda0840dcb607664593a81089020f18c9478228db9bf42cbc3db287434ad
- MD5 8831e452f55bbdbe1e059f70c69afe8d
- SHA1 18344653c836b6db75aa76ed14a21d47242fa207
- SHA512 744b6b70956a98bba3eabb039de0475dff34c995d27d750fcb58223ccf97e173a4c48ae06bd1ca86f67bef7e8d6291c57e2354bff245bea6e64e0a1ca19e9a04
- SSDEEP 384:u5cNUS2pTSZxwtpvkByGTb//vaxJZaLdE1RT5KQWnqo7dhwGnSFSPYkA3HzfKtO+:u5c2v09OsQW9QMPhd
- TLSH T14572D6734319CE26C2566A374961C29D373687206742DE78F2E82B16EDEF39803FB164
- MD5 SHA1 SHA512 SSDEEP TLSH
Nums to Arabic words.runtimeconfig.json
- SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
- MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
- SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
- SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
- TLSH T1CEE02C7BCA10ACB315F52BBAC02AC282FE20232B00004D2A35FC180C2F3AAB30012F49
- MD5 SHA1 SHA512 TLSH