buptre.zip
- SHA256 793309c193ce76f2afb4a2ac768e987cb766a5e6414acb2b8493f75913fbf2bf
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
kaisa.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
kaisa.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
main.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
main.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
simple.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
simple.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target buptre.zip
- Size 50KB
- Sample261027-dbpyxa1taw
- SHA256 793309c193ce76f2afb4a2ac768e987cb766a5e6414acb2b8493f75913fbf2bf
- MD5 2ec6998dc7e2b030ffdac6290a6da85a
- SHA1 4fde83d007157a32fde04dba69e344bc529ff8a9
- SHA512 60693da16985a38843279b3e6c47b89c63d0a815b345a2b1ed4262f43513bf0ec73e716c68f34fd969c6ed99a21cd94f30f56b0d45cbff834768c20741866676
- SSDEEP 768:46OBqJKDIKNuZiaJBD1cGttPiwhaoF6usUgkf2mHhFhWgWfxATRkPFsMZV4vr5Um:j6qJKDjoD1Xtq0Utpkuw7hA0kb4Ob8OA
- TLSH T1D633F1C22A881386D7B47773D84DDB73AABC2294F0E9C85D8845E247D81E139811B7E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/kaisa.exe unpack001/main.exe unpack001/simple.exe
File Explorer
-
buptre.zip.zip 50KB
-
kaisa.exe.exe 44KB
-
main.exe.exe 44KB
-
simple.exe.exe 44KB
kaisa.exe
- IMPHASH 04c2b2ade28632c40263779689ca341b
- SHA256 a0928cbe85bd66499631871c91bd2c72204efdaefaf2633acab37acfdc67d9bf
- MD5 01b7a69a32fd74062416092d0f7b9c7d
- SHA1 0c9c3befbf9b2f22ebec7ce3d37b2bb8a4f78eea
- SHA512 ec8ec3fae1159c501020781725a88020e430c95ab69d0907b5004681a92ae37daff48695ae7193ac54ff63a73e35c46605d62e08e717b0342721ce7805ce0d34
- SSDEEP 768:cvSk0LF1Sa7n3lmU0D/EaGYRy5pxh5KoW:cE1UTq0yYoW
- TLSH T10F138E37BCD5C433D9D682F100F24B9AAF3F952103A154D38B546E596D31EE0BA3A346
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4858
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCommandLineA
GetVersion
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetLastError
ReadFile
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
SetFilePointer
VirtualAlloc
HeapReAlloc
FlushFileBuffers
MultiByteToWideChar
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
CloseHandle
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=16, id=14, version=7299,
count=52, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=45, id=1, productName=Unmarked objects,
count=3, id=19, version=8034,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
main.exe
- IMPHASH 04c2b2ade28632c40263779689ca341b
- SHA256 0f3703cf95bff60353af4186085f500d3716548d807a03a92c5fccd23bcaa872
- MD5 3ee156ef15a26ba6849c4523a8c2403e
- SHA1 8fbe541b98f6bd7751dcfc4dcc044e2f413a50e7
- SHA512 bc2438d8829fa7f45099a06df4b13bc530772530f79bd9c692ac418a8ae5a1af1194c2f2d264c10dbcce600f0bbf57ff8237743ab59a4d31c26827282ff54a5b
- SSDEEP 384:B+Gjt17in6v88a9MbEgXvyurS60yYcW447Gl/kckd69oC+d5cepKHO5KoK84h:QGJi6vhaCn/yurz0YW4kld69AN5Kou
- TLSH T1E1138E3E3DE28033D4D283B041F68F6A6F3F6165076154D38F64AD582D319E8BA3A686
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCommandLineA
GetVersion
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetLastError
ReadFile
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
SetFilePointer
VirtualAlloc
HeapReAlloc
FlushFileBuffers
MultiByteToWideChar
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
CloseHandle
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=16, id=14, version=7299,
count=52, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=45, id=1, productName=Unmarked objects,
count=3, id=19, version=8034,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
simple.exe
- IMPHASH 04c2b2ade28632c40263779689ca341b
- SHA256 7d19794d10cf0bcfd61c932dded395cebebd81b8acb92b03536e4f81c4fb302c
- MD5 008b9828bb2fe54c50f40b4f3d654f16
- SHA1 12fad3f229d0c39d1c6b7026db4b3d9b82a2a6db
- SHA512 23072892d5ecfb309bb864e8f4c41a93b172237db4ee4439249fe61af36b259894d686a45f6df0d6da62757c798fef403835d3b394ee99693808692a8083913b
- SSDEEP 768:aypkc92aTnEBFhi8aosvzZY5rwuxjSVEh5Ko2:az+MCruxjso2
- TLSH T140138E277DD28073D4DA82B141F28B5B6F3B653507A294E3CB146D5D2D71AF0AA3E382
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCommandLineA
GetVersion
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetLastError
ReadFile
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
SetFilePointer
VirtualAlloc
HeapReAlloc
FlushFileBuffers
MultiByteToWideChar
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetStdHandle
CloseHandle
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
24KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=16, id=14, version=7299,
count=52, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=45, id=1, productName=Unmarked objects,
count=3, id=19, version=8034,
count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,