funky.zip
- SHA256 6714e49ffcb28f0ef94abbb43c60014785c554ceda3bdba1e5f06990066245ce
Overview
overview
5Static
static
3DistroClient.exe
windows10-2004-x64
3DistroClient.exe
windows11-ltsc_2024-x64
3RegistryGrip.vbs
windows10-2004-x64
5RegistryGrip.vbs
windows11-ltsc_2024-x64
5clsTCP.vbs
windows10-2004-x64
5clsTCP.vbs
windows11-ltsc_2024-x64
5frmMain.vbs
windows10-2004-x64
5frmMain.vbs
windows11-ltsc_2024-x64
5modDatabase.vbs
windows10-2004-x64
5modDatabase.vbs
windows11-ltsc_2024-x64
5modGlobal.vbs
windows10-2004-x64
5modGlobal.vbs
windows11-ltsc_2024-x64
5modWIN32API.vbs
windows10-2004-x64
5modWIN32API.vbs
windows11-ltsc_2024-x64
5Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DistroClient.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
DistroClient.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
RegistryGrip.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
RegistryGrip.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
clsTCP.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
clsTCP.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
frmMain.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
frmMain.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
modDatabase.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
modDatabase.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
modGlobal.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
modGlobal.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
modWIN32API.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
modWIN32API.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target funky.zip
- Size 48KB
- Sample261102-ls6a8avs3n
- SHA256 6714e49ffcb28f0ef94abbb43c60014785c554ceda3bdba1e5f06990066245ce
- MD5 416e0163e4bf5238c71e7ec84587c943
- SHA1 18e635f17d2fea694d5f5ae3334308a74cf5c91e
- SHA512 c0e114da665d19cdb33ad9c0136032914e30f3eaa628b07f6f816a858d199f49a787ada8f9441942f1b73775a4b0597e615258b41782d59476357f8c2ac413ec
- SSDEEP 768:F2FiHkM8flHSrPpJ9W2h1u+/pwbDisQeiUbTwTYQpIE2RaAJ:F2bdyPlT/pAmv8w0Uc
- TLSH T18333F1EC8E1185E9D2E813FD5014FEAAE13F48181699730709B1D5FE3E17F4B8E2A295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DistroClient.exe
File Explorer
-
funky.zip.zip 48KB
-
DistroClient.exe.exe 88KB
-
DistroClient.vbp1KB
-
DistroClient.vbw243B
-
DistroTaskLog.txt18KB
-
MSSCCPRJ.SCC197B
-
RegistryGrip.bas.vbs 12KB
-
clsProcess.cls1KB
-
clsTCP.cls.vbs 9KB
-
distro.reg106B
-
factory.ico766B
-
frmMain.frm.vbs 6KB
-
frmMain.frx778B
-
modDatabase.bas.vbs 11KB
-
modGlobal.bas.vbs 10KB
-
modWIN32API.bas.vbs 10KB
DistroClient.exe
- IMPHASH a9911f5e9e16cf81678582b93ddc9777
- SHA256 f24ab8ecc786414bf8c30226d1c4950e5147e224df61620406ea5fa2d8e0f12e
- MD5 e043b06629612662a6901a03ded0d3c0
- SHA1 e8138da5f2fd229f5e41820beee6d7766905a7c7
- SHA512 eadae0ee8093a68974f78164d0e37c5535dc41e02af47946e70626357eb030bb01d8677bb4f63d1e06851feff3af997104e6b2d0f781fa5793fe3fea776e1e1e
- SSDEEP 1536:eveDjseVFWu8/LlQ4+4CPqYjTsP/4W5rL4CC7yO7yk:emc6Wu8/LlXxYja4p7p7/
- TLSH T17B93FA23BFAC1111F26B5971197965728D237C352822ED0F6346EA4D1A71A83F9F132F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7020
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaRedimPreserveVar
ord587
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaVarIndexStore
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaVarCmpNe
__vbaStrCat
ord660
ord553
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
ord556
__vbaLenVar
_adj_fdiv_m32
ord666
ord669
ord592
__vbaForEachCollObj
__vbaExitProc
ord594
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
ord702
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVar
ord520
__vbaFpR8
__vbaVargVar
__vbaBoolVarNull
_CIsin
ord631
ord525
ord632
__vbaNextEachCollObj
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaDateR8
ord560
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaCastObjVar
_adj_fpatan
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
_CIsqrt
__vbaVarAnd
__vbaRedimVar
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
__vbaVarDiv
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaDateVar
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaNew2
__vbaVarInt
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
ord577
_adj_fdiv_r
ord578
ord685
ord100
ord579
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
ord612
__vbaFreeVarg
__vbaVarDup
__vbaStrToAnsi
ord616
__vbaVarLateMemCallLd
__vbaRecDestructAnsi
ord617
_CIatan
__vbaI2ErrVar
__vbaStrMove
__vbaCastObj
ord619
__vbaForEachVar
__vbaR8IntI4
ord542
ord543
_allmul
__vbaLateIdSt
ord544
ord545
_CItan
ord546
__vbaFPInt
__vbaAryUnlock
ord547
_CIexp
__vbaI4ErrVar
__vbaFreeObj
__vbaFreeStr
Name
.text
Size
76KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=7, id=9, version=8783,
count=1, id=13, version=8877,
DistroClient.vbp
- SHA256 cb516fd633957a1a3d0e75c602ded74480f630a553d3a022579d05e729cfa826
- MD5 55a04e0587cf2a3c7a9cfb7a7d74165e
- SHA1 719ff229e7dcf2f785377f6b90f50da48af5f35f
- SHA512 ab5c3abb42fcab19dec082896e515d23aef3cdefc6e087919c944d673d5c34c81d7906c2728204b93c2c4d66d87b3ba601d55ba7aee51ad89fe09d9b1f769f2b
- TLSH T1BD21B811F6107CB6D1A82154C8B4B52379DF3B6907ED00540899C9E9AE86E74D33A87E
- MD5 SHA1 SHA512 TLSH
DistroClient.vbw
- SHA256 b79e29ee4efb1ac4833740cf02da94999103aa05f1f471bd775055313ed12265
- MD5 1f508001745f63f202b5cfdcefa194f0
- SHA1 fbf249ea4a54e34caeea43def6bbe32034518956
- SHA512 ac01d36145e9cad1c2a519965b81650e5c23295a889dc244d18dd151fe0af7608a8abd6178484e9b24c820193bc6fcf8c91b6d4fe32320668c4d7b643a15edfa
- TLSH T176D0A7081E1E216D1289EFEC9800AC1F8CB8E21D061B10135679D6B3275C8495171271
- MD5 SHA1 SHA512 TLSH
DistroTaskLog.txt
- SHA256 87f223f9735da9156908d730c916448904fe479c20e83dfc6586f62fac1ba016
- MD5 2150535c1147c0a294abb92324439ca3
- SHA1 a3db2abab0def413ebac91745d4fef593910fe70
- SHA512 f46154c88559ea7b2fa99095a14d4ff520f4a4503051478e60d3d18a4e232c3e54ded00b22356706a1b74caca74525dac0a5267ffbfa2cab3812f9ae0d24a5d0
- SSDEEP 384:ijfMfMfMfMfMytGLC9qgkNTKK/qefE00000liS7RrDbSUjHraHcMpNQXQdXJzs:StGLC9qg6T//qefuSRrDbSUjLaHcMpNG
- TLSH T1F48294161FF958F9F643C8C4801AA6CEEA240441B28BB47C7F8D27563619F1ED2BF994
- MD5 SHA1 SHA512 SSDEEP TLSH
MSSCCPRJ.SCC
- SHA256 5eb29d520c4a207a638cf24ab2d63c8051d864da2ba78c0a151702050afee4a5
- MD5 0019bdd1ed1e3d648221d84302e508b1
- SHA1 312e98f94783f03f5bc1c855b034c3b303ec4b39
- SHA512 46494d42cb2f97423c830a1b1b1ee680760b779b46383f1ae188e78fbe7498ff0486bec6e00961375776a31b6e5d89a7860abb8504ff50e4648ca1b4ff854b6a
- TLSH T1B0D0220E18D4A234419D06A49347468EBB0D60C8E37210D798A2EA8FA33F167C2BFC86
- MD5 SHA1 SHA512 TLSH
RegistryGrip.bas
- SHA256 0ac463eb05332866e944da68203a18258f9b1aaf6716d45ccb202ad82af42ecd
- MD5 a2f57fb41d045f889e2fd6f6bceded7b
- SHA1 6a51e23d0431c0abc0273191f5bc3f0d85a496fb
- SHA512 be4662f76433d13907c91026bc3356c1d5502c55223dc33ddfa7cf66de267a37a191ed3ea31ff5d2f63cc9ef1c0baf6975a956b5d6125f316e5d9da6fcad1753
- SSDEEP 384:RxR2vYE2lEZCEYUOopxKpZs7isLs3DJ2bgb6k3N08k0:XRCYhlcCtUxQZgi4GR08d
- TLSH T10342659AFC07C63449BAE3245C67C5E7D8E97D4632385B40B81C56C99F728DE72E02B8
- MD5 SHA1 SHA512 SSDEEP TLSH
clsProcess.cls
- SHA256 b84dd1edf7a5789190f596a704a6d9dc939a70487d1e9bb8a04367d20a6d3ca8
- MD5 89a0c4c136adc80cf9e9491ac62819db
- SHA1 1430a5159935526a6e808ce144f2454b8f977b08
- SHA512 af35ad9dd2b870eca5c2e872a042b69ce9cb00ccff2eaf0e235c3aec1ff8c27f665ac1dc0fd7384cb83f1a0490ef917146c1a18325773f0bfc45c81d6392aab5
- TLSH T15C3148581E8F0CB1C8ED6120AD1B75A399958481303F03A67B24E1CFAF59BC5A1EC63B
- MD5 SHA1 SHA512 TLSH
clsTCP.cls
- SHA256 f197e25466bffe4e8fd12061d22be9e811be199a99ca69dd52b76b9b8e914030
- MD5 344b9a3f6221055d01ebde7feabf2373
- SHA1 1cc9f9747ccfcf32bd68eff922157a282b9df621
- SHA512 e166883e27b172af7bccb2b525b761bd8502a2355f84be9e86f82cec2f7d2ce328ffdbe4e98ab521039c9d74fd72f91fa04263ea0f880adc04842c12388fa7e4
- SSDEEP 192:aAcep5JSslhETfeuR5oSHgAQW+X3s53WH6n7q8wL/Q+IlwK+/g6Js:1cefMah0f3hTQWqcBII2JLxI6KMS
- TLSH T17822A98DBA447D355CF18904A80A941ADC6436AB0BB308F7F09C95BD4F7616BE1F07EA
- MD5 SHA1 SHA512 SSDEEP TLSH
distro.reg
- SHA256 2e4b2eec1c04e268fbc02e3bf3bd456c6c3aaa8c1fb691c6725705fc76d6781f
- MD5 ab4e674e712c1701eadcfd72e0291e2a
- SHA1 3e4da7e48eeffd43f88ebe772e205bfb70bf1aaf
- SHA512 51741268170d7e02403482ed46a1931cc94b659beccbf2b3040d17eb9f7e3233de049c2f542201e135adefe155a7c49aa482e1d022fd48265fcd1714fe489d74
- TLSH T18EB012100E260DAD24BD44808D20C140371C905A32834D042359D64227918D274AD12E
- MD5 SHA1 SHA512 TLSH
factory.ico
- SHA256 28b02fc39d204ab953e75fc2cabbebaa5709b731688aeee8e46ce663b25e7ea8
- MD5 d88cd57df4903e661c70847ed51ae9f0
- SHA1 d94146b58d37077a8a264c9b589e83e8ddc80dbb
- SHA512 e3c87820128437c05dc244c6d29b7f160490cc63bd5de9f89091477ff16c3e907de019a0e96684f860a0f9e4e933695c56e3525c2bf050f5553ee19e0bf31d8b
- TLSH T1C001CD4EB212234CC89806314EDB6BFB586EECE5FC100092F2D0BA6D3D71321264BCB8
- MD5 SHA1 SHA512 TLSH
frmMain.frm
- SHA256 9a9b8d4d96eefe47316e400e8863c075019ad2dffabe599d34931424b9f3e362
- MD5 eb39ac39208cd670a492b919020f2ade
- SHA1 5da68ba8bb59a038c289c7547a60007f7db52df7
- SHA512 5c0edb5d2b6eb398b2e953324d481ee6d3afa531e75a94389ad9f31c22c9fd4a8eeff0c272e07d1abe102425ec8b9a753f31d8c9c232770441d74e1135b4a1a1
- SSDEEP 192:WF2pu+/lFJmvkjEd7K5aaBwdlfAsKoAWe:WSHMv+SdlIKe
- TLSH T140E123057F8183309577D525AC2BBA16ECB5151368932C30765CC0E54FF1BAA62FD3AB
- MD5 SHA1 SHA512 SSDEEP TLSH
frmMain.frx
- SHA256 59a25514d539182e615eb128f62d4e59afc467216ede9898d593521cea33d613
- MD5 d0f3393e4efd9a2a72f9031b2d0e56ca
- SHA1 82e92196b56450753242728b83b6ad9feba2d28a
- SHA512 28570bfa9e1c591c1f46fa20e18c0b6162e64fe13b03cfc4d7bfd3c931de0e081d6e19d7d72277884036b6f587e7f722e0afd78b629b3ab1eca053b8384fc60e
- TLSH T19F01AF4EB212234CC45805314ED76BFA586EDCE5BD140092E2D0BA6D3D71315264BCB8
- MD5 SHA1 SHA512 TLSH
modDatabase.bas
- SHA256 ce466250e72e1ad7ee5ba4495ed3a96777466dc3d2d47aa1dcae8750b087d1de
- MD5 9da422e13a534e80e49f3fac63b9ab0e
- SHA1 e11a507eaa7198e6b3061179cf5b3a6cc31796d4
- SHA512 19de1c74005c7202f8eb04022cb54ead9639dab2a647582b7145ecd21b434a7c887c962de480bc0e4bacf391d9fdbdc12345b24381367173841faf7b6a7bee4c
- SSDEEP 192:fc3fNaNotlkR2SYLj/tPeE1DqLXr2gk2CIpLG40pagn06ToEUb5G/aB4nk4pb6fQ:fXNot1Bk2gZCIpLGwgqxxu1L
- TLSH T11132612A7B00F231683B4DB9D89B941E6CB17B16A04A44163C1CD6D04F70BDDEAB6F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
modGlobal.bas
- SHA256 82f78721a491f1297b2b0ab2494e7ac1bae528ec477907def102fd3f71585b16
- MD5 22afa834347945259f3b1707b274c9b3
- SHA1 3409be55150c9087c8c45fd4d8be013297da5a1a
- SHA512 694ca0b33008a747393cdd598f6ab6bdd23e43412005f704692126a8d33b4fb76d441006299e9c506d5f566ef3a5150ef340041129124153d904fba1ccac67cd
- SSDEEP 192:db19iuFLR0yJV3P0a9pJltOWJyY7/fQ4/ryT+mN3WHi0vKeKvM4oQnAS7LmJQXRZ:d90KMa9rXQBCmN3YiyQXRfXh
- TLSH T131226429760421B188FE5D3CEC09E42BD8F41A23A17B5422788CC6D64F75BCE67D1EAD
- MD5 SHA1 SHA512 SSDEEP TLSH
modWIN32API.bas
- SHA256 dad0704cd8982360d34cb73e403b3c2ea696f50824b386fbc226948af86b51bf
- MD5 389676f73a61596e9616890139bbd6b9
- SHA1 a04481e18da3b0f1038af8044fa7bd14d9c9066a
- SHA512 208414c324b16a032380cc68b19cb881bde65c1954eab2a1ac13ddaff6ba927f98f99486b38754864a2f2a46ae53986c9bf79dac197e4b35be9f80d35a40137f
- SSDEEP 192:FnWrVr1df7+g9FxXIy9VNjGypgSZsByqL4jBm29nR7OnwD/r:MlFVrGQdLOiE29nRKI
- TLSH T17222649FAD4E237184B96272B98F78BBDED85018307A0771746CC2DA0FF56CA13E2654
- MD5 SHA1 SHA512 SSDEEP TLSH