MessageForm_1.1.1.1.zip
- SHA256 980f6ab5f47bcc2f752336cbcd3496b7121b598a12f1dec9afb8f2c5fcc3600a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MessageForm.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MessageForm.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
libwebp_x64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
libwebp_x64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
libwebp_x86.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
libwebp_x86.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target MessageForm_1.1.1.1.zip
- Size 642KB
- Sample261104-xjle8stycy
- SHA256 980f6ab5f47bcc2f752336cbcd3496b7121b598a12f1dec9afb8f2c5fcc3600a
- MD5 beb57005783a16cd4bfd8ffe83e29592
- SHA1 d9fb0a8b01d428d0d61b272792b309611ecb1706
- SHA512 1ae81bbdacbc8d07f421e13aae96263bcf284cdf9b8c59c8c8f83b97fc03899c56bb6259d7e9433674ccd816f0ab114e4b4366e5ed8f0dff44dc77b9877a29c1
- SSDEEP 12288:0IAdTqBYtcPxXH4jQgB9hBbQbuMk4E64TynoWoVaxJt2z/E5ynRconJs:0IyqBYG5XHGQQ9hBbLMk4E64wgEabE5/
- TLSH T1DDE423CF8AF770ECE90EE494A7984AD12DE20C855745961303FAB527B356E271F23938
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/MessageForm.exe unpack001/libwebp_x64.dll unpack001/libwebp_x86.dll
File Explorer
-
MessageForm_1.1.1.1.zip.zip 642KB
-
MessageForm.exe.exe 361KB
-
libwebp_x64.dll.dll 583KB
-
libwebp_x86.dll.dll 508KB
-
license.txt2KB
MessageForm.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 672ec37b905063eca2138a4bbec82b67f69a8f0f42ebf1ce0e8bec0713b0854c
- MD5 ba706bae7a21fee307a2fdabfccdae90
- SHA1 bf248f59df2542e565eaa9db04bdccd3a8d11cfc
- SHA512 a43adc363e4764bc937102d3e26594baf552786192d8420d8b45b3ca8cb86ea11827bcb4af0d47fe2d85896340efafaef4db06b5e73d215d09bc498e2d7a1290
- SSDEEP 6144:2X9BW4n+ntoeCk9qaIrkjlexA3uSqBm+uum:94n+ntoeCk9qaIrkIWtqrm
- TLSH T11F742C1322EE3E89D1794770B77753D0C37EAE169A1AC65E08C4258C5ABE703B6027E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
332702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Petr\Documents\Visual Studio 2015\Projects\MessageForm\MessageForm\obj\Release\MessageForm.pdb
mscoree
_CorExeMain
Name
.text
Size
317KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
libwebp_x64.dll
- IMPHASH 9ddc64f586009775eabd3db5c98c00c6
- SHA256 8391c2c412905f82c43b536a14956914acc53c0bf25a317488a47cbfb4ea772a
- MD5 5d55c80c9f57a6bb71997915dcadbce4
- SHA1 96d454abb9750d4b97f82761e8b37507932b7e5f
- SHA512 29d8309e70ea13c19139d6c51a8a1aa0d64a0e6b744ba184c190d114c373a6734818dfcf0e34c7d562febecb6950d3a4ebc27d76a0e3d6289269d3326b050ae5
- SSDEEP 12288:/CeYglbkDQxi0x3hXmhG9a/VGLrLrLrL8KWeu8oA9uY:/CeVbxiZ/oLrLrLrL8KRu8b
- TLSH T133D46B4EE59625D8E46BD078CABE561AB2753C1C035495FB03D4BA3A2E37BC0573BB02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
411472
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
WaitForSingleObjectEx
SetThreadPriority
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteConsoleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
VP8CheckSignature
VP8GetCPUInfo
VP8GetInfo
VP8LCheckSignature
VP8LGetInfo
WebPBlendAlpha
WebPCleanupTransparentArea
WebPConfigInitInternal
WebPConfigLosslessPreset
WebPCopyPixels
WebPCopyPlane
WebPDecode
WebPDecodeARGB
WebPDecodeARGBInto
WebPDecodeBGR
WebPDecodeBGRA
WebPDecodeBGRAInto
WebPDecodeBGRInto
WebPDecodeRGB
WebPDecodeRGBA
WebPDecodeRGBAInto
WebPDecodeRGBInto
WebPDecodeYUV
WebPDecodeYUVInto
WebPEncode
WebPEncodeBGR
WebPEncodeBGRA
WebPEncodeLosslessBGR
WebPEncodeLosslessBGRA
WebPEncodeLosslessRGB
WebPEncodeLosslessRGBA
WebPEncodeRGB
WebPEncodeRGBA
WebPFree
WebPFreeDecBuffer
WebPGetColorPalette
WebPGetDecoderVersion
WebPGetEncoderVersion
WebPGetFeaturesInternal
WebPGetInfo
WebPGetWorkerInterface
WebPIAppend
WebPIDecGetRGB
WebPIDecGetYUVA
WebPIDecode
WebPIDecodedArea
WebPIDelete
WebPINewDecoder
WebPINewRGB
WebPINewYUV
WebPINewYUVA
WebPIUpdate
WebPInitDecBufferInternal
WebPInitDecoderConfigInternal
WebPMalloc
WebPMemoryWrite
WebPMemoryWriterClear
WebPMemoryWriterInit
WebPPictureARGBToYUVA
WebPPictureARGBToYUVADithered
WebPPictureAlloc
WebPPictureCopy
WebPPictureCrop
WebPPictureDistortion
WebPPictureFree
WebPPictureHasTransparency
WebPPictureImportBGR
WebPPictureImportBGRA
WebPPictureImportBGRX
WebPPictureImportRGB
WebPPictureImportRGBA
WebPPictureImportRGBX
WebPPictureInitInternal
WebPPictureIsView
WebPPictureRescale
WebPPictureSharpARGBToYUVA
WebPPictureSmartARGBToYUVA
WebPPictureView
WebPPictureYUVAToARGB
WebPPlaneDistortion
WebPSafeCalloc
WebPSafeFree
WebPSafeMalloc
WebPSetWorkerInterface
WebPValidateConfig
Name
.text
Size
449KB
Virtual Size
448KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=27412,
count=9, id=259, version=27412,
count=135, id=261, version=27412,
count=3, id=257, version=27412,
count=94, id=1, productName=Unmarked objects,
count=30, id=261, version=30034,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=109, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=256, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
libwebp_x86.dll
- IMPHASH a5b9e4604626e344adb7e1cf8edd6b35
- SHA256 9986023bb6ff5510a157919f0cd958a94800ec6a1d981f3403a9648bedfee575
- MD5 9f44ce48ce2d89dcab71dbec725f42f5
- SHA1 1a22228f521276e00c26bda8fc75517e66930a4b
- SHA512 a79c2bf6e513c44f5bc78ce0e9c02e9b5e68d236ef05ffc2275ab4cea1bb04d55f013337896b95b10cdbfdfa9f0bebb17636f280e1156ffbaa56cdbacaf5424b
- SSDEEP 12288:3lzpYS+gTkzkAGVcPsGlZOnhUIAPMFK0ePOoF:JpYS+g4wAGiXl4+kot
- TLSH T112B48D41AAC375E2D88F24F454BDB6BE25381E04831CCCF7A7D47E26A9322D05A73796
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
341942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
WaitForSingleObjectEx
SetThreadPriority
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
CreateFileW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
DecodePointer
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
VP8CheckSignature
VP8GetCPUInfo
VP8GetInfo
VP8LCheckSignature
VP8LGetInfo
WebPBlendAlpha
WebPCleanupTransparentArea
WebPConfigInitInternal
WebPConfigLosslessPreset
WebPCopyPixels
WebPCopyPlane
WebPDecode
WebPDecodeARGB
WebPDecodeARGBInto
WebPDecodeBGR
WebPDecodeBGRA
WebPDecodeBGRAInto
WebPDecodeBGRInto
WebPDecodeRGB
WebPDecodeRGBA
WebPDecodeRGBAInto
WebPDecodeRGBInto
WebPDecodeYUV
WebPDecodeYUVInto
WebPEncode
WebPEncodeBGR
WebPEncodeBGRA
WebPEncodeLosslessBGR
WebPEncodeLosslessBGRA
WebPEncodeLosslessRGB
WebPEncodeLosslessRGBA
WebPEncodeRGB
WebPEncodeRGBA
WebPFree
WebPFreeDecBuffer
WebPGetColorPalette
WebPGetDecoderVersion
WebPGetEncoderVersion
WebPGetFeaturesInternal
WebPGetInfo
WebPGetWorkerInterface
WebPIAppend
WebPIDecGetRGB
WebPIDecGetYUVA
WebPIDecode
WebPIDecodedArea
WebPIDelete
WebPINewDecoder
WebPINewRGB
WebPINewYUV
WebPINewYUVA
WebPIUpdate
WebPInitDecBufferInternal
WebPInitDecoderConfigInternal
WebPMalloc
WebPMemoryWrite
WebPMemoryWriterClear
WebPMemoryWriterInit
WebPPictureARGBToYUVA
WebPPictureARGBToYUVADithered
WebPPictureAlloc
WebPPictureCopy
WebPPictureCrop
WebPPictureDistortion
WebPPictureFree
WebPPictureHasTransparency
WebPPictureImportBGR
WebPPictureImportBGRA
WebPPictureImportBGRX
WebPPictureImportRGB
WebPPictureImportRGBA
WebPPictureImportRGBX
WebPPictureInitInternal
WebPPictureIsView
WebPPictureRescale
WebPPictureSharpARGBToYUVA
WebPPictureSmartARGBToYUVA
WebPPictureView
WebPPictureYUVAToARGB
WebPPlaneDistortion
WebPSafeCalloc
WebPSafeFree
WebPSafeMalloc
WebPSetWorkerInterface
WebPValidateConfig
Name
.text
Size
392KB
Virtual Size
391KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=17, id=259, version=25711,
count=142, id=261, version=25711,
count=20, id=260, version=25711,
count=3, id=257, version=25711,
count=87, id=1, productName=Unmarked objects,
count=24, id=259, productName=VS2017 v15.6.6 build 26131, version=26131,
count=28, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,
count=15, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,
count=108, id=260, productName=VS2017 v15.7.4 build 26431, version=26431,
count=1, id=256, productName=VS2017 v15.7.4 build 26431, version=26431,
count=1, id=255, productName=VS2017 v15.7.4 build 26431, version=26431,
count=1, id=258, productName=VS2017 v15.7.4 build 26431, version=26431,
license.txt
- SHA256 4dec898a639f86b7b5dfbe4ee15f2ac6516247f3bcb70c569ac0a25db15d3260
- MD5 1e73a71abc798c742ed32632cd471dfd
- SHA1 86e16908fdcd179f7a15abdc644af6084888ffb5
- SHA512 98f9db0df8fa220a25d63687b7b4454dc911b3aa4df4c773c50ab09440badb44404fcb59308dddbfd1ebade91f33faa00a224fe56671271048b93455d47ad6f3
- TLSH T12C51A45F6E490BA309E2D7902569E8C4F059E02D3F672A05386EF208537B42D85FF480
- MD5 SHA1 SHA512 TLSH