Files.zip
- SHA256 0950597d3f6a747c6e7b2255475cfe3c559c6812d400abd8e6e07802758eef93
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Files.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
General
- Target Files.zip
- Size 8.7MB
- Sample261030-ndtd8aec83
- SHA256 0950597d3f6a747c6e7b2255475cfe3c559c6812d400abd8e6e07802758eef93
- MD5 106f4accfb3fba8600ec5c32cfef8900
- SHA1 32aed06f772318cec5d8fc1aefbad5e3d8dc70b1
- SHA512 2413dfcd1ee851d509f509ba0540fd0863d5233f10e7756528316b94acdb4488ff3d8c575fe2952172897df2fd45b8e8992588bd4a04305bc37ba53e749bb06e
- SSDEEP 196608:ZY5rrgoaf82r2eiUdCXJF59GqYZ1sW1jjF/XcFi6APoW+ywz6pU:wHMf8k2e/d8JFC95t5XcFi6fByvU
- TLSH T1439633223640FA8394B0E79CE2AEFC61A2ADB7E5C2D33187D355C105F5D45026C6B7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dropper.exe
File Explorer
-
Files.zip.zip 8.7MB
-
cache.dat202KB
-
config.bin7.7MB
-
data.db382KB
-
dropper.exe.exe 1.2MB
cache.dat
- SHA256 1c0f2f8ffc3ee13bcc4eb0fd4034437a059b52a601d88a32ed01742317fae93c
- MD5 15ac1e03a3742024038e850b11792606
- SHA1 e90194cd5db6758c826a5c41edb6cb097579b29c
- SHA512 3d392f2768a90bc11b32c85d9d0dbd20cd51ac1a6e0f2765ee36f74adf72f7ebf0d590c07fe081aa31f5a22ab032a4669024eeadd152e1a2d20d61995f2c574c
- SSDEEP 3072:mizaB3CpfIvjJH8Hn8gIsv5O73FuoDF7iTgAAMHAlxVw8rt5IlhvpY9/ae2zmSHr:1ATK8zsvE1ukiTnAhHR5SRY9/ae2J
- TLSH T13E1413D47570673B92F50DB8E1F641C2BDDBE6DE67E2134B90362198E302E2E585E2C2
- MD5 SHA1 SHA512 SSDEEP TLSH
config.bin
- SHA256 5696d1504ae111ae99641d2d486686681ff542a55dcb85c18f3a0e2309c9ff89
- MD5 48fe29a828161a59d9e7a8e201fcfe81
- SHA1 2340b4e5706d4b883dcd0defddd054242d427f33
- SHA512 0547b50bd4c77e3f8817ba452b53f6f8bd29a523b341c3675b427687fd6772da39c07ca983b7a39947118f24ebf70b9c1671468eb3e28da28f49f46dc8b05ad5
- SSDEEP 196608:dCeSFHQWjYUkQ5M9TDTlKSgNZsQ5ZnVjVihgCsPsQG8EzC8:dcFHQCYUz5eTDk13DpVihgCdJ8o
- TLSH T15F8633323740E9839460E78CD2AEFC24F26DA7E9C2C73957D349C009B5D4506BD97ADA
- MD5 SHA1 SHA512 SSDEEP TLSH
data.db
- SHA256 d194e2df01ed48a92052fedc8e04a880cf0a82a808958506eea1fef15c070877
- MD5 835de764de5861467f9e543e8d5920a4
- SHA1 0afe2f2abd797b9a2cf16bc281eb0dd0e1572600
- SHA512 4b2f31ab194a0f08e2a5c0606dba238e8e24fb85ad42ffe9c81cb76619953993e68f2e8cb317563973522a6a9321f45016bb72cf029a57c8e243c4a7e22d3701
- SSDEEP 6144:nDPizmmiBmNUgi9koEHuBwclbq6egKSI/VWlu+vv0WtMThP4c64XjDP0c74jQ5s/:r0mmiBkUPkodDl8d6VST5Q4XnFUP++
- TLSH T19A842322A50D73CF2ACB49DEBA01FD79129A7E61D370E6435D023923954C878173B72E
- MD5 SHA1 SHA512 SSDEEP TLSH
dropper.exe
- IMPHASH f21c0046b635966eaa3261309b44c90e
- SHA256 ef3586d07a42b900392861e1fff1a7775d1d7b0e0d7ec226301b4da6e44c4022
- MD5 b420e9022f5d6e1f02fe723b6c9a25ff
- SHA1 44d211084b68fd47dbfe294b26120b5008c6dcfb
- SHA512 0d115bb04321459c921885f9f3bc122bf08e96595768cd20754e61a3ef3ac5c444d1a6460d0a28e2835e9925a825d00c7e49baea012afdd7103321207fff0266
- SSDEEP 24576:1h0h0jqq9CWojgna6oC/Va8rj0gSOmdzqDAoX:Pa0jqlWojga6oC/Va8rGOmdzqDAoX
- TLSH T1CF557CD2718559DDE612803B827392BAA17633843332DBF30E58DD356F49ADA2F56F08
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddVectoredExceptionHandler
CancelIo
CloseHandle
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreatePipe
CreateProcessA
CreateProcessW
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerExW
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DuplicateHandle
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetTempPathW
GetThreadContext
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeProcThreadAttributeList
IsThreadAFiber
LockFileEx
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleW
ReadFile
ReadFileEx
RemoveDirectoryW
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetStdHandle
SetThreadContext
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFile
UnmapViewOfFile
UpdateProcThreadAttribute
VirtualAllocEx
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFileEx
WriteProcessMemory
lstrlenW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwindEx
VirtualProtect
VirtualQuery
__C_specific_handler
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
msvcrt
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_fpreset
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
wcslen
ntdll
NtCreateFile
NtCreateNamedPipeFile
NtOpenFile
NtReadFile
NtSetInformationFile
NtWriteFile
RtlNtStatusToDosError
userenv
GetUserProfileDirectoryW
ws2_32
GetHostNameW
WSADuplicateSocketW
WSAGetLastError
WSARecv
WSASend
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
Name
.text
Size
680KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ