95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.zip
- SHA256 b411efd2ddd05e61462422886e2a7522025eaa92aaf2d8a1252d15871dcad72b
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
36 signatures
900 seconds
General
- Target 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.zip
- Size 78KB
- Sample261106-qs85bsca27
- SHA256 b411efd2ddd05e61462422886e2a7522025eaa92aaf2d8a1252d15871dcad72b
- MD5 59f829e3025f61afd19a239fe40129d7
- SHA1 3e9de8ab47df0fa28b7732499682bc5dd164b5cb
- SHA512 23a9b943208149fbe2830f728593429c4231ddcf109d9c9c66e305167b63c9c51e542470af37a16ff79ffdeb33f67d96710de32a2ccbfdeefc18198d7ea123b5
- SSDEEP 1536:WUmgZ91aTQGutblP6suXb5W6ghSqT5aFS2mNGyKpOwivVcYX:xmg9x74Xb5W6ghXaFSlGlOHvVcYX
- TLSH T1417302088755C17DC573AA6CEC18F29F7EADC429B62B184EE5EA7053F44214B91027F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe
File Explorer
-
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.zip.zip 78KB
-
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe.exe 146KB
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe
- IMPHASH e9f710b579880d1b6ff748176eb620f1
- SHA256 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf
- MD5 69bec32d50744293e85606a5e8f80425
- SHA1 101b90ac7e0c2a8b570686c13dfa0e161ddd00e0
- SHA512 e01f976fcbfa67cfd6e97855d07350a27b67fcc825d4e813ac9d2f4e8f464bb4f8bbbbe58a26bc27e78fa15db0ee5271e8f041dd72f036c11964eb1c591b438f
- SSDEEP 3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVcH:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMcH
- TLSH T138E31725F156E276C4E70BB07668CFF658E8A434232090F7DBED0A5C18E4BE16E37256
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
93712
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
netapi32
NetApiBufferFree
NetShareEnum
iphlpapi
GetAdaptersInfo
ws2_32
WSAGetLastError
htons
connect
socket
inet_addr
WSAStartup
select
closesocket
__WSAFDIsSet
WSACleanup
ioctlsocket
crypt32
CryptBinaryToStringA
gdiplus
GdipGetImageEncodersSize
GdipDeleteGraphics
GdipDeleteStringFormat
GdipGetImageGraphicsContext
GdipDeleteFont
GdipCreateBitmapFromScan0
GdipSetStringFormatAlign
GdipSaveImageToFile
GdipCloneBrush
GdipDrawString
GdipFree
GdipDeleteBrush
GdipAlloc
GdipDisposeImage
GdipCreateLineBrushFromRect
GdipSetStringFormatLineAlign
GdipCreateFont
GdiplusStartup
GdipGetGenericFontFamilySansSerif
GdipCreateStringFormat
GdipDeleteFontFamily
GdipGetImageEncoders
GdipFillRectangle
GdipCreateFontFamilyFromName
shlwapi
PathAddBackslashW
PathFindExtensionW
PathRemoveBackslashW
PathRemoveExtensionA
StrFormatByteSize64A
PathRemoveFileSpecW
mpr
WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW
WNetGetConnectionW
WNetAddConnection2W
ntdll
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
NtSetInformationThread
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQueryInformationToken
RtlGetAce
NtOpenProcess
RtlQueryInformationAcl
RtlAllocateAndInitializeSid
RtlAddAce
RtlLengthSid
NtClose
RtlAdjustPrivilege
RtlFreeSid
RtlAddAccessDeniedAce
NtSetInformationProcess
RtlCreateAcl
NtWaitForSingleObject
NtSetInformationFile
RtlDosPathNameToNtPathName_U
NtCreateIoCompletion
NtRemoveIoCompletion
NtQueryInformationFile
RtlInterlockedPushEntrySList
RtlInitializeSListHead
RtlInterlockedPopEntrySList
RtlInterlockedFlushSList
RtlInitUnicodeString
NtAllocateVirtualMemory
LdrEnumerateLoadedModules
RtlAcquirePebLock
RtlReleasePebLock
msvcrt
malloc
calloc
free
kernel32
GetLocalTime
GetProcAddress
SetThreadUILanguage
GetConsoleMode
GetWindowsDirectoryW
GetCurrentProcess
GlobalFree
GlobalAlloc
ReadFile
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
GetModuleHandleA
SetProcessShutdownParameters
SetConsoleMode
WriteFile
GetConsoleWindow
SetConsoleTitleA
FindVolumeClose
SetVolumeMountPointW
FindFirstVolumeW
QueryDosDeviceW
GetVersion
CreateProcessA
lstrcmpiA
GetCurrentProcessId
MoveFileExW
Process32Next
CreateToolhelp32Snapshot
OpenProcess
GetUserDefaultUILanguage
TerminateProcess
GetSystemDefaultUILanguage
Process32First
LoadLibraryA
OpenMutexA
CreateMutexA
GetTickCount
Sleep
GetTempFileNameW
GetTempPathW
GetDriveTypeW
lstrcmpiW
ExitProcess
CreateThread
CloseHandle
DeleteFileW
GetDiskFreeSpaceExW
SetFileAttributesW
ExitThread
GetFileAttributesW
CreateFileW
FindClose
SetConsoleTextAttribute
WaitForMultipleObjects
FindNextFileW
FindFirstFileExW
GetLogicalDrives
AllocConsole
SetConsoleCtrlHandler
user32
wsprintfW
GetMessageW
GetSystemMenu
SystemParametersInfoW
DeleteMenu
wsprintfA
CharUpperA
SetWindowLongA
PeekMessageW
GetWindowLongA
wvsprintfA
RegisterHotKey
FlashWindow
SetLayeredWindowAttributes
EnableMenuItem
MessageBoxA
GetSystemMetrics
GetShellWindow
GetWindowThreadProcessId
IsWindowVisible
ShowWindow
CharLowerBuffW
advapi32
CloseServiceHandle
RegQueryValueExW
RegDeleteValueW
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
RegQueryValueExA
OpenProcessToken
DuplicateToken
OpenThreadToken
GetTokenInformation
SetSecurityInfo
RegOpenKeyA
RegCloseKey
GetSecurityInfo
EnumDependentServicesA
SetThreadToken
OpenSCManagerA
ControlService
QueryServiceStatusEx
OpenServiceA
SetFileSecurityW
CryptAcquireContextW
SetSecurityDescriptorOwner
CryptGenRandom
LookupPrivilegeValueA
CreateWellKnownSid
CheckTokenMembership
InitializeSecurityDescriptor
CryptReleaseContext
shell32
SHEmptyRecycleBinW
ShellExecuteW
SHGetFolderPathW
ShellExecuteExA
ShellExecuteExW
CommandLineToArgvW
ole32
CoGetObject
CoUninitialize
CoInitializeEx
Name
.text
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=257, version=26126,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=9, id=260, version=27032,
count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=226, id=1, productName=Unmarked objects,
count=15, id=265, version=25017,
count=6, id=259, productName=VS2017 v15.0 build 25017, version=25017,
count=1, id=258, productName=VS2017 v15.0 build 25017, version=25017,