Deathwing.rar
- SHA256 ed49f66f787e1117e05fbc686209103a330918c99be74d8d100474cd3d451556
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rDuOc.exe
Resource
win11-20260911-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target Deathwing.rar
- Size 27.1MB
- Sample261102-b1es5aztdx
- SHA256 ed49f66f787e1117e05fbc686209103a330918c99be74d8d100474cd3d451556
- MD5 d84cf5a4057ff26c3706da61f4c52edc
- SHA1 79b8316134155de4cdb71b10f4a88df2d5f31b23
- SHA512 89c2ce2baff9fb61635b452230c7d1e1c7928237d0abf64dcc263a37b74d6938179757857439da7c9189d45db309884569749ef5de50bca94d12cb580588f486
- SSDEEP 786432:2ZiO5LHJ8YAB04OpcvbeBr+xmVsLB+yTzydGw8O2pUFcvF1:25FR1pD+h1+yXyEwbqZvX
- TLSH T10A57332AA174571DE30EDA280C4DD0D42559A6DCF739AC90170CA675BCFEBC08B63FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/rDuOc.exe
File Explorer
-
Deathwing.rar.rar 27.1MB
-
rDuOc.exe.exe 27.2MB
rDuOc.exe
- SHA256 8e444edb9685214b5ea503c948ea5091e2510f00c0ca71db3c456041117bceb9
- MD5 b02b9ac9daf84d8b51e16fe3e296746b
- SHA1 45d15446fe66f9582541292b4bcf0fbc077788c9
- SHA512 c5ccb97723fef53a687dbf5416f4d0123d5073892e4671331c6cef60ac8a0dccfccc450e358ca9a42c13449522acf2599c714fd63b8955cb311d3b1b7c33fa4c
- SSDEEP 786432:WOxiKfRV8bqt12BBZxm4C2hyLlm953KHs:dnfO0sm46U3KM
- TLSH T1AD57330D9C572C8BF4AE13B13E75C845E280CB3E1DF5D259290EE56B84929AEE7370E4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
47677528
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
1.6MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
385KB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
786KB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
94KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
17KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vbcq
Size
Virtual Size
39.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
24.4MB
Virtual Size
24.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=208, id=261, version=33145,
count=28, id=260, version=33145,
count=12, id=259, version=33145,
count=4, id=260, productName=VS2019 v16.8.2 build 29334, version=29334,
count=104, id=260, productName=VS2019 v16.4.0 build 28314, version=28314,
count=35, id=261, version=25019,
count=1, id=259, version=25019,
count=1, id=260, version=25907,
count=2, id=123, version=2207,
count=7, id=253, version=28518,
count=19, id=260, version=30034,
count=10, id=259, version=30034,
count=97, id=261, version=30034,
count=1, id=262, version=33145,
count=695, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=32, productName=Unmarked objects (old),
count=8, id=260, productName=VS2019 v16.11.9 build 30139, version=30139,
count=21, id=257, version=33145,
count=385, id=1, productName=Unmarked objects,
count=35, id=265, version=30159,
count=1, id=259, version=30159,
count=1, id=255, version=30159,
count=1, id=258, version=30159,