DK4-NB.7z
- SHA256 cf13d93dec4a2fd1f8f1889572ecf8bf9edb9e335e8f0d6e126611ca0fae8e2c
Password
sG8*tWz7yigW
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28T0K.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
28T0K.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
uzZN66l.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
uzZN66l.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target DK4-NB.7z
- Size 17.0MB
- Sample261029-eh2rqag18x
- SHA256 cf13d93dec4a2fd1f8f1889572ecf8bf9edb9e335e8f0d6e126611ca0fae8e2c
- MD5 355e7a4e5054e7db678622b3f30bc32e
- SHA1 9e0bf30db52d963a7ffb7018580c0ba912674b2a
- SHA512 b19d5bf4cd2d5b81cd6eb63c62014586ef1a4c23c0ea1be896634b6186bcc9c22b6ba219bffd9f7d6db399fc8b3ecd35d5ac7460bd7ca41067c314332b84667f
- SSDEEP 393216:RuTKkYDhpHyEPVmBe6sHlx0fWQ8tDKvAU:K3YdpHymVSsHb0OQ8tDWAU
- TLSH T1070733EEFEC4CC8B63E01A88AE7755A15125FD37B73C28ADDB55BC46E9008304C785A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/28T0K.dll unpack001/uzZN66l.exe
File Explorer
-
DK4-NB.7z.7z 17.0MB
-
28T0K.dll.dll 4.0MB
-
RCInx8Cw.K0d.png 14.6MB
-
uzZN66l.exe.exe 81KB
28T0K.dll
- IMPHASH fd0c6736b4536d21a4c5374f3b0f0905
- SHA256 2ce2bc485adb69187c66a51ec1a11390c2d9904df9611211834039847a52d53a
- MD5 6f7ba98ff556445dd3feacd124e885e1
- SHA1 05b443647d118513e7e8fb15eac4156ac9dff022
- SHA512 ba32205bc3fcfdf436410376d564a937c1c9523b8ceba8c929059905490a1b4c857fa96061511b6a45634e04e3e4eda97a66219b156bab7f539bcd7246e0d022
- SSDEEP 98304:dFC6Ms3QfhOPN6KMbKKsbFizAsKV+diyNN/zV5VDSvY:dQ6MsOhANlZxiAnVSioDS
- TLSH T1E016120368C42175F6B7D712779B845EE3C270497A866C5F2682094242F1EE7BB873AF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
sG8*tWz7yigW
Minor OS version
0
Major OS version
6
Entry point
3170336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
LocalAlloc
AkhYWBFFXYi
COWFoXEJAYJuPsTn
EPuXvoShQaUU
EgsAClhNsPeNWKSk
EphXgDHG
EqbFG
EwfbTHQjvtTYeh
FJTWtvqQgiLQurWOQ
GRBMBZSpqDpLD
HaQtgdXpFpKXFmIOre
KGUOKuez
Kuv1u8ZhV5T_jIGZ
LPJmzBCCxqTeHKmlyolEVzy
LXSGpOKt
ODtFNsyllDUKlqRPlWoFcEPLGZW
PZZ8NEfX0
PtA19qwaZzkeZSNn
PxPHkliqXtxmIC
QfxFmAYlgNMfJx
SAAkcaGHspJq
TfmNzapQcWFz
UNoHuRyoDwOiTNTeYvuMxuwK
VaVHScTBkNtywh
WCUnSlyATldF
WNiGvateLOZWyqfHYpr
ZObHxDJQIubs
_xLNiwjp9Kz
_xhh9ZSt
aFQFWSBSpOijRWYX
a_Uxi3lr1vTkyL
cDGUtNTeSib
caprdAGtc
cuzkAptehndl
dFSYwThcmTHYTGlNhaWCpwg
fMorL1MKqjG0238R
fxhnzvaBK
hShFLGrLZGfmT
kTRVbvbqvEAnYeHx
lzpGUWvoFjXwFfHdeI
pwjRLAiuFiYoEueGIHs
rJaMOyzvXbPhKHPQFchr
rrThjweAkrEq
rsGxPR1479CQ_
uVstkxcg
wYKwzVXgeLGWfWQiNqNf
wbHdZLXBSdCy
zxUJLhXoXblZnvYlu
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.}g\
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.j?x
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.DPF
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
RCInx8Cw.K0d
- SHA256 cbfcba215dc4d52364532a63d8c6d90ee0111a2f0e4f3af7f3ff67a84565f56a
- MD5 371712e423f2aeb34a5b79b537e1abdb
- SHA1 2437208e974883720f9908dc824e853890de2301
- SHA512 29292f8c41d1de2abf855eaa3d189309e7d009ba8b0709afa8dc0ff5d3e7e22b03cdeb6cc5c01011806cea36b3412e78e7e83838240bf2b339cf60c6d93c9d70
- SSDEEP 393216:NAyFLPpc+qaWyoTzxShm74FdXC2CEBsHy26dG4:NAyRKAEMIk4y5L
- TLSH T186F6331CD08C96B8D2F30A0A62D56BD800CC39C5E77E4BC5A618EEE417BFD55381AF69
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
sG8*tWz7yigW
uzZN66l.exe
- IMPHASH 40daf2d867e451af1f5d9d180588bb7a
- SHA256 23e3ad6cd4bb5cec331f28257913de316056dc41f2b5e612b64c68a35ef55544
- MD5 eba38ee2d8a7c8f745400acdf35d42db
- SHA1 f8f180dc4ebd068bb907bf24578dc189e0a33630
- SHA512 489f6108e9d2cf938b18bcbb40b205d4083002a3bf334fc888aa63f1012f4bdaea66979c3e410bd76911ce19170c3246371a690f90591bfbddd5dad29d7d2f8a
- SSDEEP 1536:omYSYxGfIZnRnD6M7EFOUa5vcphtUnbKXF4O7W:nYFZnRDGd2vCXUbK1RW
- TLSH T12683B50263E94619F1F77A346AB652305E777C91AE38C68E0298911D1FF3E90CD74BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
sG8*tWz7yigW
Minor OS version
1
Major OS version
6
Entry point
30292
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_amd64\amd64\tapinstall.pdb
28t0k
hShFLGrLZGfmT
cDGUtNTeSib
TfmNzapQcWFz
pwjRLAiuFiYoEueGIHs
KGUOKuez
EgsAClhNsPeNWKSk
SAAkcaGHspJq
uVstkxcg
FJTWtvqQgiLQurWOQ
wbHdZLXBSdCy
ZObHxDJQIubs
AkhYWBFFXYi
EphXgDHG
rrThjweAkrEq
zxUJLhXoXblZnvYlu
QfxFmAYlgNMfJx
cuzkAptehndl
caprdAGtc
PxPHkliqXtxmIC
rJaMOyzvXbPhKHPQFchr
EwfbTHQjvtTYeh
aFQFWSBSpOijRWYX
VaVHScTBkNtywh
HaQtgdXpFpKXFmIOre
fxhnzvaBK
GRBMBZSpqDpLD
wYKwzVXgeLGWfWQiNqNf
EqbFG
COWFoXEJAYJuPsTn
dFSYwThcmTHYTGlNhaWCpwg
WNiGvateLOZWyqfHYpr
lzpGUWvoFjXwFfHdeI
WCUnSlyATldF
LPJmzBCCxqTeHKmlyolEVzy
kTRVbvbqvEAnYeHx
ODtFNsyllDUKlqRPlWoFcEPLGZW
UNoHuRyoDwOiTNTeYvuMxuwK
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
378B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=63, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=189, id=1, productName=Unmarked objects,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=4, id=138, version=30729,
count=1, id=126, version=50727,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,