sheild sloted[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
sheild sloted.zip
Size 307KB
Sample261030-srbhsac16w
SHA256 c5d9108ca5065f23a09e743b3c3712e3d1ed1e6c1579ff6475951ab430239663
MD5 55702463e78b81755babb1435a35df06
SHA1 d74e8da6f36020106ee8e4e2d971d491b17c2b5b
SHA512 3868203a97adc95ce5c9c1346ab280f34080e77199b2bd2d922eab136cf75935e2f35437ea1803e58e42eb147e4201d87ed3722602b8744243dc94818d6c3325
SSDEEP 6144:Wg/kyFACug4N/G5jdUjtC1RteIE6VuxDhriZHtH+guR4W6OYa1AhNHbl5:uymCxJEoLe4IhrlDg7r
TLSH
T1A76423816341CC12C83ED0B286A55E7B622B1D4FA79F313BD3629D5E58A3C9B1C7474E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/sheild sloted/VMProtectSDK64.dll
unpack001/sheild sloted/shiedslotted.exe

File Explorer

sheild sloted.zip

.zip 307KB
sheild sloted/VMProtectSDK64.dll

.dll 116KB
sheild sloted/shiedslotted.exe

.exe 4.7MB

sheild sloted.zip

SHA256 c5d9108ca5065f23a09e743b3c3712e3d1ed1e6c1579ff6475951ab430239663
MD5 55702463e78b81755babb1435a35df06
SHA1 d74e8da6f36020106ee8e4e2d971d491b17c2b5b
SHA512 3868203a97adc95ce5c9c1346ab280f34080e77199b2bd2d922eab136cf75935e2f35437ea1803e58e42eb147e4201d87ed3722602b8744243dc94818d6c3325
SSDEEP 6144:Wg/kyFACug4N/G5jdUjtC1RteIE6VuxDhriZHtH+guR4W6OYa1AhNHbl5:uymCxJEoLe4IhrlDg7r
TLSH
T1A76423816341CC12C83ED0B286A55E7B622B1D4FA79F313BD3629D5E58A3C9B1C7474E
MD5 SHA1 SHA512 SSDEEP TLSH

sheild sloted/VMProtectSDK64.dll

IMPHASH 1851ff453adce0cef5274e320d5bed3c
SHA256 af82c309ace1ce81c23aa190c65f4eaa4e2e668e227175e66b0637b56f546796
MD5 724d8234d574846b6ee2262a2977650d
SHA1 b3fb659ddb3306e23342a0232b9b85e924ae36d5
SHA512 3ea5ed4fb38986098d19221e5dbf4f48a0ccf5c912235bfdc160bb949721c298e904bbaa1070beb67cb9cfdabb0163a7a51e593f37e2bc03c69b7200c3967e83
SSDEEP 3072:xmcqYHq7Aiytzg2ScpvgJcG5sqYX6UmHRlBS:80Hq7AiyegZgJZSX+xH
TLSH
T1F6C36C57B3E540BBE1B6C679C8634A55D3B678150B24DBAF07A402162F233D18E3AF72
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

sheild sloted/shiedslotted.exe

IMPHASH 069952a0b175ef18eca97359b517aea1
SHA256 ab8c8a85fdcf15b32dec8a898885ef4713b7998be38acaf559e75c879451c7cc
MD5 993552828371d2300436434215f1603b
SHA1 b6dd522510c0c42ee7871f33df383bf73812293a
SHA512 e5281df8a66ccd1419f74c1af33b392cf17a44dd70e833d6abb8263ae335863528a2133108faf36c13955b70ef909ef9e86af768e72ea6be6b29ad8cbff5e6d2
SSDEEP 12288:CH2lyul/zSzDiDo99jHld8oz1GFlt84sBcZEBmC1+04hR4F:EZuVzSzDk2Z8o0DsBKE
TLSH
T14B366C69A56940F9D2A7D1F8CD534C02E7B2B8064361EADF0794E5B21F33AD09A3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

172448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\7\Desktop\all my s\Yeni klasör\NewLoader\bin\Release\NewLoader.pdb

vmprotectsdk64

VMProtectBeginVirtualization VMProtectBeginMutation VMProtectEnd

virtdisk

DetachVirtualDisk GetVirtualDiskPhysicalPath CreateVirtualDisk AttachVirtualDisk

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

iphlpapi

GetAdaptersInfo

advapi32

QueryServiceStatus OpenProcessToken OpenServiceA CreateServiceW CloseServiceHandle OpenSCManagerW GetUserNameA DeleteService ControlService StartServiceW OpenServiceW QueryServiceStatusEx RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenSCManagerA RegOpenKeyExA RegQueryValueExA

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptSetProperty

kernel32

HeapReAlloc FindFirstFileExW FindNextFileW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetVolumeInformationA SetConsoleOutputCP ReadFile GetLogicalDrives FindFirstFileA SetConsoleTitleA WriteFile DeviceIoControl FindNextFileA GetTempPathW GetEnvironmentVariableA FindClose WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot Sleep FreeEnvironmentStringsW GetLastError GetFileAttributesA Process32NextW CreateFileA LoadLibraryA DeleteFileA DeleteFileW Process32FirstW CloseHandle CreateThread GetLocalTime GetProcAddress LocalFree GetFileSize ExitProcess ReadProcessMemory GetCurrentProcessId CreateProcessW WideCharToMultiByte GetConsoleWindow CreateProcessA CreateDirectoryA GetTempFileNameA GetDriveTypeW VirtualQueryEx GetComputerNameA FlushFileBuffers GetFullPathNameW GetLongPathNameW SuspendThread ResumeThread GetModuleHandleA MultiByteToWideChar GetTickCount64 GetThreadContext GetThreadTimes VirtualProtect SetLastError GetCurrentProcess OutputDebugStringA RtlUnwind Thread32Next Thread32First GetCurrentThread Module32FirstW Module32NextW IsDebuggerPresent CheckRemoteDebuggerPresent GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW HeapFree GetConsoleMode SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetTempPathA TerminateProcess GetConsoleOutputCP HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent FreeLibrary GetModuleHandleExW GetModuleFileNameW GetCommandLineA

user32

GetClassNameW GetWindow GetDC ReleaseDC ShowWindow GetSystemMetrics GetTopWindow

gdi32

SelectObject DeleteObject SetStretchBltMode DeleteDC GetDIBits StretchBlt CreateCompatibleDC CreateCompatibleBitmap

winhttp

WinHttpReceiveResponse WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable

Name

.text

Size

321KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

sheild sloted.zip

sheild sloted/VMProtectSDK64.dll

kernel32

generic

sheild sloted/shiedslotted.exe

vmprotectsdk64

virtdisk

wininet

iphlpapi

advapi32

crypt32

bcrypt

kernel32

user32

gdi32

winhttp

generic