ir-x86_64-pc-windows-msvc.zip
- SHA256 837fa9e53f70e89ad93a095873981b4c5872d00669597df503990c2924caa96f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ir-x86_64-pc-windows-msvc/ir.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ir-x86_64-pc-windows-msvc/ir.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ir-x86_64-pc-windows-msvc/rx.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
ir-x86_64-pc-windows-msvc/rx.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target ir-x86_64-pc-windows-msvc.zip
- Size 787KB
- Sample261029-1psy2stw2j
- SHA256 837fa9e53f70e89ad93a095873981b4c5872d00669597df503990c2924caa96f
- MD5 e310d05c18e521ea4cd062bc18e050c4
- SHA1 ea8dd6f142ba0fa15ce627e8c720c1e51f0ff4c9
- SHA512 a0ea129efe0e6fad1832a21991329a22256e903e2436d604104e980482d4cea86d77e567e51ef7dd297ccf5374e2d93b8eba1f068c304496f8dee694561b8020
- SSDEEP 24576:gE0wCQff/8cfnGJ6z/iZOsPEHuZoTppYvYGvOqFqq:pf/8InGJ6zighOZoTpANOsqq
- TLSH T1FA05236D96CF1585F728DE992010AF85ECD4567C20593F22888927AF177E2F9CFA0C1E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/ir-x86_64-pc-windows-msvc/ir.exe unpack001/ir-x86_64-pc-windows-msvc/rx.exe
File Explorer
-
ir-x86_64-pc-windows-msvc.zip.zip 787KB
-
ir-x86_64-pc-windows-msvc/LICENSE1KB
-
ir-x86_64-pc-windows-msvc/README.md4KB
-
ir-x86_64-pc-windows-msvc/ir.exe.exe 1.5MB
-
ir-x86_64-pc-windows-msvc/rx.exe.exe 226KB
ir-x86_64-pc-windows-msvc/LICENSE
- SHA256 1996e3d1070ef31e3ab3681e721053a85a686a8196c9073020207e3e3d3eb694
- MD5 1261cba6d9295dc218ab5025c59c3bb0
- SHA1 e2dc713021d26254ec0f64c4f4a0e0535deaf57f
- SHA512 a1018007c958a72d51e8aed23b11b79d4d190374aed9cddd808f831617ee031ce3215fc8c6e14d47b83795c319628abfc090346fbce06868d37c5a1c0ea32fa7
- TLSH T15E11821E73960373189257A055B9ECC5F22BB18ABFAB1A84346EF2091326058C9FFC64
- MD5 SHA1 SHA512 TLSH
ir-x86_64-pc-windows-msvc/README.md
- SHA256 b4c3cee2206f8de528102a2c54c325f3c3c2c29f1cb1d8bab2e494c2ed23c7e2
- MD5 9520a3b990ce197e1b4b402cab7a5b48
- SHA1 7d238fa0f45e7ce4313b0affdeba1483e9e674f7
- SHA512 420c6ca053a00a867ac811f85ba2869cca696b957a659b96404212ba65a2c7e151ffa55e397cef9d7df6bacd8899277d89ab64ad53a1a3c0537c4f6c35d50635
- SSDEEP 96:EmUWMXAIy1EnpLCa17M20GjbvpE5nJEBndAYtxzzcLFGa+kG:TU6h20McnJEBnSYz8B4kG
- TLSH T1AB91A5777B0AE379611143B790AEB6D0F336400D3A2AA451B18FA11C0315FB58B5E6BF
- MD5 SHA1 SHA512 SSDEEP TLSH
ir-x86_64-pc-windows-msvc/ir.exe
- IMPHASH 203af92c10146c3ee2192cf0eef09230
- SHA256 93109f2853b902ae9dc2859fbc16abfece0adaaf916b7a8b576b79adafd5abfd
- MD5 0f6c1bf50c6c8bb62e76186ad457ef35
- SHA1 4881443a486d783ef74b222461daf71da6ea95a6
- SHA512 ac4b35e8053f95ba2ab011e78b6ec9839ae6b078cf2e7161be5f21a37f923ae8937436206379b447b1436c45d6e325ba35dbf53c4ad7455262d337794cce7bac
- SSDEEP 24576:22u3A/b8ZO0Q0w8V+Xc/TMLrEqbkOAczjb4pUQcj:22u3090wO7wLrPkOAczjb4pS
- TLSH T126752A15BB9A686CD15AC87083468A735A3430CB1B36BDFF50D892753FA9AF41B3C718
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1216400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ir.pdb
kernel32
CloseHandle
SetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleMode
GetFileAttributesW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
FindNextFileW
GetTempPathW
GetModuleHandleA
CompareStringOrdinal
GetLastError
FreeEnvironmentStringsW
WaitForSingleObject
WriteFileEx
SleepEx
SetLastError
GetFullPathNameW
GetCurrentThreadId
MoveFileExW
SetFileInformationByHandle
CreateFileW
SetFileTime
GetProcessHeap
HeapFree
HeapReAlloc
QueryPerformanceCounter
CreateThread
CreateEventW
GetCurrentProcessId
ReadFileEx
ReadFile
GetOverlappedResult
LockFileEx
GetCurrentProcess
DuplicateHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetSystemTimePreciseAsFileTime
CancelIo
GetFileInformationByHandle
GetFileInformationByHandleEx
GetEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetExitCodeProcess
GetStdHandle
CreateDirectoryW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
lstrlenW
FindFirstFileExW
FindClose
ExitProcess
SwitchToThread
GetProcAddress
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
GetFinalPathNameByHandleW
DeleteFileW
HeapAlloc
GetModuleFileNameW
MultiByteToWideChar
WriteConsoleW
GetConsoleOutputCP
IsProcessorFeaturePresent
GetFileType
GetModuleHandleW
FormatMessageW
WaitForMultipleObjects
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
ntdll
NtWriteFile
NtOpenFile
NtCreateNamedPipeFile
NtReadFile
RtlNtStatusToDosError
vcruntime140
__current_exception
__current_exception_context
__C_specific_handler
memset
memmove
memcpy
__CxxFrameHandler3
memcmp
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_seh_filter_exe
_set_app_type
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_crt_atexit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
329KB
Virtual Size
329KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=9, id=260, version=35207,
count=23, id=261, version=35207,
count=9, id=257, version=33145,
count=184, id=1, productName=Unmarked objects,
count=103, productName=Unmarked objects (old),
count=1, id=258, version=35228,
ir-x86_64-pc-windows-msvc/rx.exe
- IMPHASH 5a73889727f40250ad466064b0da6c14
- SHA256 31347d06bf9ba7af25ea26e554539fb8cd22a1bb83a193f994eb8ab0a29d1bc5
- MD5 54231c4c453c455bee3e14deb7925d4d
- SHA1 dcb07b1931589368927993fbd5a3123a3d5d12e0
- SHA512 1e61316e9422b2f5eb21b07399f53c49429291f28efb59aefa0b4ed27ff362dad0b78aec762d1871d307e4568d2cf897ca908dce6a8a95cbd2764033569eba71
- SSDEEP 6144:2k3LgZvfdnt1tzQCxE0su1kHLR0JqiM6YZhxA:1SJzR
- TLSH T192345A217E455DACD44AC07882458A73A53278CB0B36F9FF02E852397F6A9F66F3C214
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
164720
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
rx.pdb
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
kernel32
GetModuleHandleW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
CloseHandle
CompareStringOrdinal
GetLastError
FreeEnvironmentStringsW
WaitForSingleObject
WriteFileEx
SleepEx
SetLastError
GetFullPathNameW
GetCurrentThreadId
SetFileInformationByHandle
CreateFileW
SetFileTime
GetProcessHeap
HeapFree
HeapReAlloc
QueryPerformanceCounter
CreateThread
GetCurrentProcessId
ReadFileEx
GetCurrentProcess
DuplicateHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetExitCodeProcess
GetStdHandle
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
lstrlenW
ExitProcess
GetProcAddress
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
HeapAlloc
GetModuleFileNameW
MultiByteToWideChar
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
GetFileAttributesW
IsProcessorFeaturePresent
FormatMessageW
GetModuleHandleA
GetSystemTimeAsFileTime
ntdll
NtWriteFile
NtCreateNamedPipeFile
NtOpenFile
RtlNtStatusToDosError
vcruntime140
memcmp
__current_exception_context
memset
_CxxThrowException
__C_specific_handler
__current_exception
memmove
memcpy
__CxxFrameHandler3
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_configure_narrow_argv
exit
_exit
_set_app_type
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_seh_filter_exe
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Name
.text
Size
165KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=9, id=260, version=35207,
count=23, id=261, version=35207,
count=9, id=257, version=33145,
count=181, id=1, productName=Unmarked objects,
count=18, productName=Unmarked objects (old),
count=1, id=258, version=35228,