Imageprocessor.zip
- SHA256 4510ada2208d9b8b0579c9fc6530369bd9f6769416e4f3adae6ecb16984651fa
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Imageprocessor/BuildStudio.bat
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Imageprocessor/ImageProcessor.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Imageprocessor/ImageProcessor.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
150 seconds
General
- Target Imageprocessor.zip
- Size 16.1MB
- Sample261104-3yrtfset3t
- SHA256 4510ada2208d9b8b0579c9fc6530369bd9f6769416e4f3adae6ecb16984651fa
- MD5 e9f90c99ef89921bb8ffb93d560dddf8
- SHA1 6dba987f9af118d6e53292d8c459884bb83e4cf2
- SHA512 be53029eb361f86eaa8cfb223ea92acd001bca4e0056df3e8b374f055ceaf8e5f7e4c5502cdeae2f49e81f48a1f98c46335cc3752c06c0ec0dd3a8d3622a1075
- SSDEEP 393216:OpUN4TzcBDc6eA+Rs/FxVjh4NVpFd2CXV:+UWTzce69cs/FxVjh4tFd2+V
- TLSH T167073345B638B9D36746BD3BF71DBC3D840D5AEB19E9C9282C921731093909E14ACFCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Imageprocessor/ImageProcessor.dll unpack001/Imageprocessor/ImageProcessor.exe
File Explorer
-
Imageprocessor.zip.zip 16.1MB
-
Imageprocessor/BuildStudio.bat.bat 1KB
-
Imageprocessor/ImageProcessor.cs7KB
-
Imageprocessor/ImageProcessor.dll.dll 16.1MB
-
Imageprocessor/ImageProcessor.exe.exe 8KB
Imageprocessor/BuildStudio.bat
- SHA256 c24889946003338e4eea7d1a04c3799fbe1afa0b2c937a25d77ebd5e4325dccd
- MD5 3ce1a06ceda4f9ff5d1f494a20d2dd09
- SHA1 709300e57a7f4b871a8629d2d3bfc50442a03d1e
- SHA512 a1a0d4dcb37bc7fb497110306ec1a80b568fc301067019c82930693a5c52d33489df1dd922e86dc18d190e6e9e471ea38eefee66b9e62c08bd516a1f834256d5
- TLSH T176211F9C521E9960D0BD50D17520625BFA8B80972A138F2C7001F41AEFB0B80C9FAB95
- MD5 SHA1 SHA512 TLSH
Imageprocessor/ImageProcessor.cs
- SHA256 4e6e4272f1369e93664d95c4e3c0d1f06da41b7cf4806267fea0244ec79980aa
- MD5 261542d2567a7a961f23b78e4134f70d
- SHA1 128130e153f889cc30ac555ef253021f39e1f9ee
- SHA512 5890dca7b6852512c09f30d25a3fb43d4ffa9ebc71ff50dccdb0906dcf31f60da0aec656a88d81ec7c8bbdf283ed00591f2a19da0d8831f61ee026535fed706d
- SSDEEP 96:Coyz0zY2pDrQaLZ+oEvLF3XSqZGKGnIg3zyX4D6V6FzRY6FUZ6FOyJCQvW:wiP3CNXSlfIgyuFzhFTFxJCaW
- TLSH T136F101095A5F188205F36328BFA24EA7CFBA005703652B7A3F7E62445F3942C93A5F56
- MD5 SHA1 SHA512 SSDEEP TLSH
Imageprocessor/ImageProcessor.dll
- IMPHASH b6ccdbfd1e511e0c0e59b394577a4802
- SHA256 8290cb6ae1da9198fe44aa65440e1b9911c5b6703754207715cba1872c964381
- MD5 5e04f7165d362e21a9883e0d55b956ed
- SHA1 91338e4b2a0b6f030a1fddb1764894f4e2b1ba82
- SHA512 e6c8580f8afc9121fbcfe7672597c944d5b9e047829b39e6b893801238cfcd451aefceb0a90d6ce90dda9fec9733534b7891af41bdf247e539ffd37e52026087
- SSDEEP 393216:jlALaDlsT1qoCCEFMPFhXbrY5Dp5vmC/C:xAGDlsMo1EMPFhXbrYb5vmqC
- TLSH T17F073346B77860E7E366BE3AE71B6C2D8609796606E5CB2F289106310E370DD1C7CF85
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5380
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
CreateProcessA
DisableThreadLibraryCalls
lstrcpyA
lstrcatA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
DllMain
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.expdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=3, id=257, version=33145,
count=96, id=1, productName=Unmarked objects,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=32, id=261, version=35207,
count=1, id=260, version=35228,
count=1, id=258, version=35228,
Imageprocessor/ImageProcessor.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 68464161a4d280c7a292dd872999d9875dba1932d3ede694e724cb0779abb87b
- MD5 529d90e9d0e36855b0a8d5d0c7bb483c
- SHA1 3ecd3b023a2dbfe9bf2c75f7c88159564e8559ba
- SHA512 739fd48d3ece3dcba8174103dfe807272c4d13e085bc5446811f21e28d780c29a5ff81bc484ab864cbf71be071ae9e7b7f45ce8cb5636171ad02e9f758b09c82
- SSDEEP 192:Nv2bfR/49fQ3QhZXd2WeBLt5EU8kwb62OIc:NSg9fisZXdg5EU8Du2OI
- TLSH T11502A502A3F8CA1BE8FE577529F3531153B5B29246A3DB8F2D8921DE9F2271485123D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ