fil.zip
- SHA256 de1f77e3f510a3785b6299b67f418f538374f88af5eb96947e2b97c3c17540e7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fil.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral2
Sample
fil.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
900 seconds
General
- Target fil.zip
- Size 8.7MB
- Sample261030-pc4dgads5k
- SHA256 de1f77e3f510a3785b6299b67f418f538374f88af5eb96947e2b97c3c17540e7
- MD5 3844ae86466b6c3b6baa5a6967396ccb
- SHA1 756e194d9c1496f497a789716daf41b54c495c10
- SHA512 90d9cdd084aad9cd0e63cb455aba64936115a79e971daa766a2fb6864523df1ab4e4798d9827384c29775e6efac23d5c78664332b89a35e0dd8cadb5ea997b89
- SSDEEP 196608:m5Y5rMgoaf82r2eiUdCXJF59GqYZ1sW1jjF/XcFi6APoW+ywz6u:mQYMf8k2e/d8JFC95t5XcFi6fByM
- TLSH T1869633223640BA8394A1A78DE2AEFC61F2ADBBE9C2C33587D305C105F5D45067C577EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/drop.exe
File Explorer
-
fil.zip.zip 8.7MB
-
cache.dat202KB
-
config.bin7.7MB
-
data.db382KB
-
drop.exe.exe 1.2MB
cache.dat
- SHA256 1c0f2f8ffc3ee13bcc4eb0fd4034437a059b52a601d88a32ed01742317fae93c
- MD5 15ac1e03a3742024038e850b11792606
- SHA1 e90194cd5db6758c826a5c41edb6cb097579b29c
- SHA512 3d392f2768a90bc11b32c85d9d0dbd20cd51ac1a6e0f2765ee36f74adf72f7ebf0d590c07fe081aa31f5a22ab032a4669024eeadd152e1a2d20d61995f2c574c
- SSDEEP 3072:mizaB3CpfIvjJH8Hn8gIsv5O73FuoDF7iTgAAMHAlxVw8rt5IlhvpY9/ae2zmSHr:1ATK8zsvE1ukiTnAhHR5SRY9/ae2J
- TLSH T13E1413D47570673B92F50DB8E1F641C2BDDBE6DE67E2134B90362198E302E2E585E2C2
- MD5 SHA1 SHA512 SSDEEP TLSH
config.bin
- SHA256 5696d1504ae111ae99641d2d486686681ff542a55dcb85c18f3a0e2309c9ff89
- MD5 48fe29a828161a59d9e7a8e201fcfe81
- SHA1 2340b4e5706d4b883dcd0defddd054242d427f33
- SHA512 0547b50bd4c77e3f8817ba452b53f6f8bd29a523b341c3675b427687fd6772da39c07ca983b7a39947118f24ebf70b9c1671468eb3e28da28f49f46dc8b05ad5
- SSDEEP 196608:dCeSFHQWjYUkQ5M9TDTlKSgNZsQ5ZnVjVihgCsPsQG8EzC8:dcFHQCYUz5eTDk13DpVihgCdJ8o
- TLSH T15F8633323740E9839460E78CD2AEFC24F26DA7E9C2C73957D349C009B5D4506BD97ADA
- MD5 SHA1 SHA512 SSDEEP TLSH
data.db
- SHA256 d194e2df01ed48a92052fedc8e04a880cf0a82a808958506eea1fef15c070877
- MD5 835de764de5861467f9e543e8d5920a4
- SHA1 0afe2f2abd797b9a2cf16bc281eb0dd0e1572600
- SHA512 4b2f31ab194a0f08e2a5c0606dba238e8e24fb85ad42ffe9c81cb76619953993e68f2e8cb317563973522a6a9321f45016bb72cf029a57c8e243c4a7e22d3701
- SSDEEP 6144:nDPizmmiBmNUgi9koEHuBwclbq6egKSI/VWlu+vv0WtMThP4c64XjDP0c74jQ5s/:r0mmiBkUPkodDl8d6VST5Q4XnFUP++
- TLSH T19A842322A50D73CF2ACB49DEBA01FD79129A7E61D370E6435D023923954C878173B72E
- MD5 SHA1 SHA512 SSDEEP TLSH
drop.exe
- IMPHASH f21c0046b635966eaa3261309b44c90e
- SHA256 15f25e8990ee4fe0c6c02252d214d5ffecfc3b4b0d6227c1344647875bdeabef
- MD5 f95e761da59335de7d3b4c3a184718dc
- SHA1 4072e84c7004027cf8439b279f833fa99a20847b
- SHA512 4554700351d83ec701813755452f53d49ebc51aa0ff4719bc3bab75e11ef52f4a447366b2245ba62c5f398aff7602bf8e21076c27d27da515ffeeae2362398a8
- SSDEEP 24576:Ih0h0jqq9CWojgna6oC//a8rjbgSOmdzqDAoX:ma0jqlWojga6oC//a8rROmdzqDAoX
- TLSH T156557CD2718559DDE612803B827392BAA17633843332DBF30E58DD356F49ADA2F56F08
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddVectoredExceptionHandler
CancelIo
CloseHandle
CompareStringOrdinal
CopyFileExW
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateHardLinkW
CreatePipe
CreateProcessA
CreateProcessW
CreateSymbolicLinkW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerExW
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DuplicateHandle
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessId
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTimePreciseAsFileTime
GetTempPathW
GetThreadContext
GetWindowsDirectoryW
HeapAlloc
HeapFree
HeapReAlloc
InitOnceBeginInitialize
InitOnceComplete
InitializeProcThreadAttributeList
IsThreadAFiber
LockFileEx
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleW
ReadFile
ReadFileEx
RemoveDirectoryW
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCurrentDirectoryW
SetEnvironmentVariableW
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetStdHandle
SetThreadContext
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepEx
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnlockFile
UnmapViewOfFile
UpdateProcThreadAttribute
VirtualAllocEx
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFileEx
WriteProcessMemory
lstrlenW
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwindEx
VirtualProtect
VirtualQuery
__C_specific_handler
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
msvcrt
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_fpreset
_initterm
_onexit
abort
calloc
exit
fprintf
free
fwrite
malloc
memcmp
memcpy
memmove
memset
signal
strlen
strncmp
vfprintf
wcslen
ntdll
NtCreateFile
NtCreateNamedPipeFile
NtOpenFile
NtReadFile
NtSetInformationFile
NtWriteFile
RtlNtStatusToDosError
userenv
GetUserProfileDirectoryW
ws2_32
GetHostNameW
WSADuplicateSocketW
WSAGetLastError
WSARecv
WSASend
WSASocketW
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
ioctlsocket
listen
recv
recvfrom
select
send
sendto
setsockopt
shutdown
Name
.text
Size
680KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ