7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.zip
- SHA256 b186962cf3b43d93b8dd0346f5e3b6f611c8bf93946b14c504e881d94fa4dcbf
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.zip
- Size 2.5MB
- Sample261102-pq3dbstvht
- SHA256 b186962cf3b43d93b8dd0346f5e3b6f611c8bf93946b14c504e881d94fa4dcbf
- MD5 b2ad4c11ff87bd1a1696e30e2e321f58
- SHA1 1c2a335551e4ae8dfe32d417036b361b973243e5
- SHA512 7275083ce054a5d5091481085711dc81fdc9140208112bab7596c075c681380578384706cc158f0e62e0eeef859e93594933e64095f7735acb6a9af57ba74c6a
- SSDEEP 49152:2cG1cosJKQsEdPUoPP04MWL1e2nv2Ka+lhbyE7bAWimrY5Dq95VnxQ8hZRi/c:2PnLxFaP0qY2vnamNyE7LBrdnxQ6vik
- TLSH T11FC5331E591E194EE67EA9560B78C230729051F1DA70E9C52B13DA5C7ACE3C0883BFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.exe
File Explorer
-
7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.zip.zip 2.5MB
-
7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.exe.exe 3.3MB
7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d.exe
- IMPHASH 3ef2d7ebaba2a790d37602168fc1cf0c
- SHA256 7b0e0756939eff412c5b81bcb7186c90f515acc356fd09737f6ff6725464680d
- MD5 894e0aa6422c027e8234e08c73f1a5f6
- SHA1 af75df49d89829ccfcc035320dbe29df4c968c99
- SHA512 abce42845141bdd16bf7c5ea812c8af079d98fc12ba3054817af2f626ef5b9ba4be69bee6c3263a5df1508b3caba2d2b644c24b39628cd58346f1bc7c6bb5131
- SSDEEP 49152:9QnVmO/f4WdC0Hrqq4kQScIPa/c/Ie1PHCfUqKsZz5llW:omgPuI1QsqKsZ9nW
- TLSH T1ACF53357F4D566DEF0A16D3D1460C380B3923B92470A9F9E3B921ABAFDA83114F22D74
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
180224
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
FlushFileBuffers
HeapReAlloc
HeapSize
GetConsoleOutputCP
GetConsoleMode
CloseHandle
CreateFileW
WriteConsoleW
VirtualProtect
SetFilePointerEx
GetProcessHeap
LCMapStringW
CompareStringW
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetCurrentProcess
TerminateProcess
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
user32
GetSystemMetrics
GetForegroundWindow
MessageBoxW
IsWindowVisible
FindWindowW
GetWindowTextLengthW
gdi32
GetDeviceCaps
DeleteObject
CreateFontW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
GetUserNameW
shell32
ShellExecuteW
SHGetFileInfoW
SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetKnownFolderPath
ole32
CoCreateInstance
CLSIDFromString
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoUninitialize
shlwapi
PathRemoveFileSpecW
PathIsDirectoryW
PathFileExistsW
PathCombineW
StrStrW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
wininet
InternetOpenW
InternetCloseHandle
InternetGetConnectedState
Name
.debug
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gehcont
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
233B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ