dd05096f-f7e1-4936-a7d0-7477ebd72b59.zip
- SHA256 4590cd0fca05a7202b3e236b37da1de5c17b0d1d79db7a8d1c039c86c0a0f080
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
RealMalware2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
RealMalware2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target dd05096f-f7e1-4936-a7d0-7477ebd72b59.zip
- Size 4.9MB
- Sample261102-1pagpsfw4p
- SHA256 4590cd0fca05a7202b3e236b37da1de5c17b0d1d79db7a8d1c039c86c0a0f080
- MD5 7124bb561e7f7bafdf07b2a6e9bc97bc
- SHA1 87125d582827fda6109b0895e1a727ddce79ff0d
- SHA512 d2f3c54cb0f90f61cee8d566b4ea8acab2506a1d11012375839a4fb71ececf30989bcd12169e1551578dbd2d75f9e7a178087ba6c315ffce56e755a24016c992
- SSDEEP 98304:GEYziYS622vNSIXCsvB+vkJIyeWsSvcX5EVL/79imuRB2Kvr3md1g:jSF2qJSs/JrNvcps1al
- TLSH T1B836333170CB23C63983713A8C0B7686E8457F19CB94DC2625EA5318DD8B19E39D86FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RealMalware2.exe
File Explorer
-
dd05096f-f7e1-4936-a7d0-7477ebd72b59.zip.zip 4.9MB
-
RealMalware2.exe.exe 341KB
-
pcap.pcapng5.3MB
RealMalware2.exe
- IMPHASH 61b9acd1cccd034b7d72a5f4a5d6ca9c
- SHA256 e91a4af62987547438341666daa943a1ce1a5dd0be0a5ce82111849912bf4e46
- MD5 68d36715e114d008e402f6bca8792689
- SHA1 3a18598580902ce395979d31d27fd9e3523ebf50
- SHA512 fa2b3dfd1883e7723eb3e736805d809d98d32c109ceb9322ec2f51da9e4d277c421be6375ea824b9ba3cb1def376e068585a3898427d1cf66fb0b905cc83d4b8
- SSDEEP 6144:eR96wcF0s0adXDvEX075I8Sk8j41oDsqyCQLun6C:496tF0shdXXI8Skw4yohC9n3
- TLSH T13574F701F791D038F9B716F946BE61F9953C79E0172490CB63C46AFE9A25AE0AC3071B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
25616
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetFileSize
ReadFile
CloseHandle
ExitProcess
lstrcmpW
FindNextFileW
lstrcatW
lstrlenW
GetConsoleMode
GetConsoleCP
FindFirstFileW
FindClose
lstrcpyW
CreateFileW
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapQueryInformation
HeapSize
HeapReAlloc
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
HeapValidate
GetSystemInfo
GetFileType
CompareStringW
LCMapStringW
OutputDebugStringW
WriteConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
user32
wsprintfW
advapi32
CryptReleaseContext
CryptAcquireContextW
CryptGenRandom
shell32
SHGetSpecialFolderPathW
ws2_32
socket
send
inet_addr
WSAStartup
htons
connect
Name
.text
Size
252KB
Virtual Size
251KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.msvcjmc
Size
512B
Virtual Size
43B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=26715,
count=156, id=261, version=26715,
count=18, id=260, version=26715,
count=44, id=261, version=30034,
count=17, id=260, version=30034,
count=19, id=259, version=30034,
count=11, id=257, version=26715,
count=101, id=1, productName=Unmarked objects,
count=3, id=261, productName=VS2019 v16.10.0 build 30037, version=30037,
count=1, id=255, productName=VS2019 v16.10.0 build 30037, version=30037,
count=1, id=258, productName=VS2019 v16.10.0 build 30037, version=30037,
pcap.pcapng
- SHA256 a5433882dc9564e2bddcf7432175b4883d0e5781f7a950d215462072aaba19a6
- MD5 d38f2d63723fd3a967b32af0fd7f5e54
- SHA1 c6e001ce4f527108d10d655f7c3ea3e2a9e4f820
- SHA512 29d2395edf0bebdcb1149bd41f1aaff3c300268382fd8ddca11b0c70ef4d25c887d1413f8e8e4e5c7d6ab1d30bf6ee2114189f6972db6df71615aeb1ea2225c0
- SSDEEP 98304:lN4yUHwLanGCbpNSV4/pvthn395PrIpxVdw+FSw/pzv:lN45QLanGCiafn4pxg+Z
- TLSH T16546E136DD765659D0C62AF81A33B57024E0D98B8BE140307B3CB866DB2633C57DB2E9
- MD5 SHA1 SHA512 SSDEEP TLSH