b58003d9bf4789287265172ae3ffbe44712ceec27e4260454ad73b01c90e28c5.zip
- SHA256 284d4c8d1989f318c12f1dbec7c81b2ff110209230607d84132d4fb668126d48
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b58003d9bf4789287265172ae3ffbe44712ceec27e4260454ad73b01c90e28c5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b58003d9bf4789287265172ae3ffbe44712ceec27e4260454ad73b01c90e28c5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target b58003d9bf4789287265172ae3ffbe44712ceec27e4260454ad73b01c90e28c5.zip
- Size 195KB
- Sample261027-rfe66aev8k
- SHA256 284d4c8d1989f318c12f1dbec7c81b2ff110209230607d84132d4fb668126d48
- MD5 b0697dbf90832fcd28121cb98e01b88a
- SHA1 c3532a296196e4069cd3d2916c562e15e62cca92
- SHA512 38178decd0810a00df32903534da87cfa2f6c334628eff27b22af53eb9482592f71283b9953e0ea81b836f0996a11646d72e13188984fb83188727f3d93cfc4b
- SSDEEP 6144:47u/WeoUNVKozMfWe+wBU21Vfn4gECf0WgE:4WWjQVvo+u+2ffn4du5P
- TLSH T1A1142330EE08A5A343549D23769AFAA30EF5C86A5D0406076FB8C206F8C5FFB83C9595
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b58003d9bf4789287265172ae3ffbe44712ceec27e4260454ad73b01c90e28c5.exe
File Explorer
-
b58003d9bf4789287265172ae3ffbe44712ceec27e4260454ad73b01c90e28c5.zip.zip 195KB
-
b58003d9bf4789287265172ae3ffbe44712ceec27e4260454ad73b01c90e28c5.exe.exe 401KB
b58003d9bf4789287265172ae3ffbe44712ceec27e4260454ad73b01c90e28c5.exe
- IMPHASH 457d0c81f97e3b2a2d57ee08fac57fd7
- SHA256 b58003d9bf4789287265172ae3ffbe44712ceec27e4260454ad73b01c90e28c5
- MD5 759babe57a7639e30895ba080e712d6f
- SHA1 8356059c31f83ca384d946c352b21c7ffda81f64
- SHA512 d5b0359edcf6ec175f01b7877d8a6d8b6c744eede1b07e48cfbc06fb527cf7ad7f6e499b46b19b9d75aa7f9d0d6e8dffbc5fc3042d2fa55122f250d9956ed9ff
- SSDEEP 6144:gWpciXPfFq1ONvhEhuVHH+ff127w02bjXZ/5Pmq:5ciHFmEQMa95T
- TLSH T125947D2AEB9404F9E177D178C9535906DB727C4E07A1E6DF039849A31F236E09E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
120516
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
htonl
connect
htons
closesocket
inet_ntoa
ntohl
recv
__WSAFDIsSet
select
send
setsockopt
socket
gethostbyname
gethostname
WSAStartup
inet_pton
bcrypt
BCryptOpenAlgorithmProvider
BCryptDestroyKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
gdiplus
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipGetImageEncodersSize
mf
MFEnumDeviceSources
mfplat
MFCreateAttributes
MFShutdown
MFStartup
MFCreateMediaType
mfreadwrite
MFCreateSourceReaderFromMediaSource
ole32
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize
winhttp
WinHttpConnect
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpReadData
WinHttpOpen
WinHttpCloseHandle
WinHttpQueryDataAvailable
shell32
SHGetFolderPathA
advapi32
RegDeleteValueA
GetTokenInformation
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
RegCloseKey
GetUserNameA
user32
GetKeyboardState
TranslateMessage
DispatchMessageA
ToAscii
MapVirtualKeyA
GetSystemMetrics
GetDC
CallNextHookEx
ReleaseDC
SetWindowsHookExA
GetMessageA
gdi32
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SelectObject
crypt32
CryptUnprotectData
kernel32
HeapReAlloc
GetTimeZoneInformation
CreatePipe
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileAttributesExW
GetExitCodeProcess
WaitForSingleObject
HeapFree
HeapAlloc
GetEnvironmentStringsW
WriteFile
GetStdHandle
GetModuleFileNameW
FindFirstFileExW
FreeLibraryAndExitThread
ExitThread
CreateThread
CreateProcessW
DuplicateHandle
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
HeapSize
CreateFileW
WriteConsoleW
SetEndOfFile
RtlUnwindEx
RaiseException
RtlPcToFileHeader
InitializeSListHead
GetCurrentProcessId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetModuleHandleExW
GetCommandLineW
WideCharToMultiByte
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateDirectoryA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetFileAttributesExA
RemoveDirectoryA
SetFileAttributesA
GetTempPathA
IsDebuggerPresent
CheckRemoteDebuggerPresent
CloseHandle
GetLastError
CreateMutexA
Sleep
GetCurrentProcess
ExitProcess
TerminateProcess
OpenProcess
GlobalMemoryStatusEx
GetTickCount64
GetComputerNameExA
VirtualProtect
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
LocalFree
WinExec
CopyFileA
GetComputerNameA
MultiByteToWideChar
RtlUnwind
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW
WakeAllConditionVariable
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
Name
.text
Size
284KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=17, id=260, version=35207,
count=89, id=261, version=35207,
count=195, id=261, version=33145,
count=1, id=263, version=33145,
count=251, id=1, productName=Unmarked objects,
count=29, id=257, version=33145,
count=1, id=261, version=35229,
count=1, id=258, version=35229,