final.zip
- SHA256 7f2aa0870db18fc8cdf7506ed1f8fefe565b54199c849f3d41616c6f26b27a2b
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
final.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target final.zip
- Size 86KB
- Sample261102-c4ccvadh95
- SHA256 7f2aa0870db18fc8cdf7506ed1f8fefe565b54199c849f3d41616c6f26b27a2b
- MD5 4dab9b25cf217b85e1ba0837acb87aaa
- SHA1 efc902c41abfa1439f1aba3846c58247e51dcf6d
- SHA512 37e5196d760987d7c265cb1827d50f7d99a2d0235607f93933f361570eb82ff9af7a44b3cf5788fe73aa61d80863f53ae39ca2862a589c0f0f0ee0790b7394ce
- SSDEEP 1536:3EGzfsr6d0gaaoSHpK0+g9UU2Pn+lx7e3cWdo2sGsrXi:31d0gaafHItx0x2cWdoosrXi
- TLSH T196830134584FF835087AC1B0AFDDE6CD7C98DA44774E9B8980BA3AC57686CB51E03A46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/final.bin
File Explorer
-
final.zip.zip 86KB
-
final.bin.dll 183KB
final.bin
- IMPHASH 4d073abfb528e15d860f75a4da885722
- SHA256 44a0e506ace77d147961f568d910130f1e024c1939c0636f1fe57743a81c401c
- MD5 0e0fbf00d7807a39115999882955244d
- SHA1 6765d8a29b7941f20a5c83ca4727b41b87abb052
- SHA512 545431c77a675a2a4408f3bac47eb09cd2d2544b21870668a3a0fc65e3cd763a11a554bd3a23c4e2070d36ff02b5f115deacf019680fecf01011959cee02952e
- SSDEEP 3072:6DsqZ/jNozWPf2tOlTTqNr0j9xqnN76WyOYe1xOZ+RBfXupwpFYqdr/a/d:6HNozWH5TTXoN7R5YeKc+bd
- TLSH T16F045A46B3A500B6ED6382788D634A46E77274554370ABCF576083BADF2B7D07A39321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
61376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
InitializeCriticalSectionEx
RaiseException
GetLastError
HeapSize
VirtualAlloc
DecodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
HeapCreate
EnterCriticalSection
WaitForSingleObject
SetEvent
Sleep
CreateEventA
CloseHandle
GetCurrentThreadId
SwitchToThread
SetLastError
GetNativeSystemInfo
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
ResetEvent
CreateEventW
CancelIo
GetTickCount64
HeapDestroy
SetWaitableTimer
CreateWaitableTimerW
GetThreadContext
CreateFileA
SetThreadContext
GetCurrentProcess
OpenProcess
GetExitCodeProcess
CreateProcessA
GetSystemDirectoryA
CreateFileW
ExitThread
GetProcAddress
VirtualAllocEx
LoadLibraryA
GetModuleHandleA
VirtualProtect
WriteProcessMemory
ResumeThread
FreeLibrary
TlsSetValue
RtlAddFunctionTable
RtlDeleteFunctionTable
TlsAlloc
TlsFree
GetTickCount
CreateThread
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetProcessHeap
VirtualFree
HeapFree
HeapAlloc
TryEnterCriticalSection
HeapReAlloc
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
FlushFileBuffers
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetModuleHandleW
GetStartupInfoW
TlsGetValue
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetModuleFileNameW
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
GetCommandLineA
LoadLibraryExW
IsProcessorFeaturePresent
EncodePointer
OutputDebugStringW
IsDebuggerPresent
user32
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
wsprintfW
TranslateMessage
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
ws2_32
getsockopt
send
gethostbyname
WSAIoctl
closesocket
__WSAFDIsSet
socket
recv
WSACloseEvent
WSAEnumNetworkEvents
WSAEventSelect
shutdown
WSACreateEvent
WSASetLastError
WSAResetEvent
WSAWaitForMultipleEvents
ioctlsocket
connect
WSAStartup
select
WSAGetLastError
htons
setsockopt
WSACleanup
bcrypt
BCryptEncrypt
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptFinishHash
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptCreateHash
BCryptGetProperty
BCryptImportKey
BCryptHashData
secur32
InitializeSecurityContextW
FreeContextBuffer
EncryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle
QueryContextAttributesW
DecryptMessage
DeleteSecurityContext
shlwapi
PathCombineA
winmm
timeGetTime
winhttp
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpSetOption
WinHttpReceiveResponse
WinHttpOpen
����ģ��
�
run
Name
.text
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=126, id=224, version=20806,
count=11, id=223, version=20806,
count=51, id=225, version=20806,
count=19, id=203, version=65501,
count=200, id=1, productName=Unmarked objects,
count=16, id=229, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,