file-946b0d611c19258e21dcdfeedf6ef4f2f437cacc218ea72bffc591d5e124de13.zip
- SHA256 c3978a41ed9d55749e5309926451dc5b2180b1ace3418b671068e3eda466cdd3
Static task
static1
Behavioral task
behavioral1
Sample
xaudio2_9redist.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
xaudio2_9redist.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target file-946b0d611c19258e21dcdfeedf6ef4f2f437cacc218ea72bffc591d5e124de13.zip
- Size 412KB
- Sample261104-wembasbz4z
- SHA256 c3978a41ed9d55749e5309926451dc5b2180b1ace3418b671068e3eda466cdd3
- MD5 d2de0308adeadb0033567006ebaa6db6
- SHA1 3f3222a603a31f9392c5242231a254b332649a8d
- SHA512 a7ee5b2bd37fed3a08159ac659ce8be2add26843b29c5c2a3cbfcca0ddb52b70ab47eca84fbcb956ce31c89403ea1a4a55013f29fe6e6bdecb5ac68456560d5e
- SSDEEP 6144:t5K/yYOEJ1Xlr+FpCAVqjBn7xXrFzgT0qAK1S6IPXKlH/eHIl4v2onp+ikRapg8X:3yhf1MCAVkXgqKB/eHz+up+awEh4RVkt
- TLSH T18894239D5F0B74EF60BC1E12B3A5B6C20D7486A4EF50E52F4C5BA27558831D8A8B383D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
file-946b0d611c19258e21dcdfeedf6ef4f2f437cacc218ea72bffc591d5e124de13.zip.zip 412KB
-
xaudio2_9redist.dll.dll 827KB
xaudio2_9redist.dll
- IMPHASH f336e160482c81972d16c5670e93a480
- SHA256 0e01f400baa09694cacfd2cfbff0d721c17b56785d2d6e29b6fdd117f70ccc1e
- MD5 835591acabfb69a6f9dace12711f2243
- SHA1 f0103c77e4e3fb5640a6d01a79644a8cfc5e4eed
- SHA512 6a77646846a06b8f25772a24fb8414c8aa8db07ad2b1bfeae72b016a68c64326fcd0e1214aa463bae2faaaf0a019327eac911eda4de3930c541f5142e55c5289
- SSDEEP 24576:N+6PHmQBNmTqtEcl+4n0wcktNvSRbESez5:NhBI9InQMNvMo
- TLSH T18E058C53F6E549F5D16B51359167BB1BF672B40027254EFB02A086283FF3BC01ABA3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8a:a4:d3:4e:d1:94:85:d3:cd:2e:78:39:24:61:b4:77:50:3b:cc:dd:e3:de:d8:b1:38:28:72:e4:a2:02:97:dd
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 15, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:04:09:01:75:08:58:87:2d:29:00:00:00:00:01:04
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
6
Entry point
451248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\BA\4599\b\release\X64\XAudio2_9Redist.pdb
kernel32
LoadLibraryExW
GetLastError
GetProcAddress
HeapCreate
HeapDestroy
TryEnterCriticalSection
InitializeConditionVariable
SleepConditionVariableCS
GetCurrentThreadId
SetEvent
WaitForSingleObject
CloseHandle
CreateEventW
CreateWaitableTimerExW
CreateThread
GetProcessAffinityMask
GetCurrentProcess
SetThreadAffinityMask
SetThreadPriority
GetThreadPriority
GetCurrentThread
WakeAllConditionVariable
WaitForMultipleObjectsEx
CancelWaitableTimer
SetWaitableTimer
OutputDebugStringA
lstrcmpW
QueryPerformanceCounter
CreateEventExW
DuplicateHandle
CreateSemaphoreW
ResumeThread
ResetEvent
WaitForSingleObjectEx
ReleaseSemaphore
VerSetConditionMask
VerifyVersionInfoW
CompareStringOrdinal
GetProcessHeap
GetSystemInfo
HeapSize
WriteConsoleW
HeapAlloc
HeapFree
DisableThreadLibraryCalls
GetModuleFileNameA
FreeLibrary
DeleteCriticalSection
QueryPerformanceFrequency
CreateFileW
GetConsoleMode
GetConsoleCP
WriteFile
InitializeCriticalSection
LeaveCriticalSection
RaiseException
EnterCriticalSection
FlushFileBuffers
SetStdHandle
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
EventWriteTransfer
ole32
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
PropVariantClear
avrt
AvSetMmThreadPriority
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsA
version
GetFileVersionInfoW
VerQueryValueW
CreateAudioReverb
CreateAudioVolumeMeter
CreateFX
X3DAudioCalculate
X3DAudioInitialize
XAudio2Create
Name
.text
Size
547KB
Virtual Size
546KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.no_bbt
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
230KB
Virtual Size
229KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=259, version=26213,
count=143, id=261, version=26213,
count=14, id=260, version=26706,
count=16, id=259, version=26706,
count=39, id=261, version=26706,
count=11, id=257, version=26213,
count=1, id=263, version=26213,
count=20, id=260, version=26213,
count=144, id=1, productName=Unmarked objects,
count=4, id=261, version=27034,
count=1, id=259, version=27034,
count=106, id=265, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,