para-triage-somente-binarios.zip
- SHA256 d954621bc71c8c391ad4aaa3a158b1d4cc9bb499e8927149d04da30d468752cd
Password
infected
Behavioral task
behavioral1
Sample
para-triage-somente-binarios.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
audiodg.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
300 seconds
Behavioral task
behavioral3
Sample
taskhost.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
300 seconds
Behavioral task
behavioral4
Sample
taskhostw.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
300 seconds
Behavioral task
behavioral5
Sample
unsecapp.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
300 seconds
General
- Target para-triage-somente-binarios.zip
- Size 54.4MB
- Sample261107-vybs8sdv8x
- SHA256 d954621bc71c8c391ad4aaa3a158b1d4cc9bb499e8927149d04da30d468752cd
- MD5 def140163d773aa92f23c2b687a5040a
- SHA1 7036f073881584b921af07c3a2a3fefb70c3d7eb
- SHA512 0ddf6f4e9850ba2371e623004064a5110d5e2b8bcb9348d5168916b9d4727c59017d164557349fce2f687565ca2122adc1aede0f40a9ed8a1d6713f309aa6cd2
- SSDEEP 1572864:eMmW6S18dPR0usXzgKzMpympB7SAaBit3+WrmBV6nsof:5p6o8DsXzgKKpBLFtLrmBV/of
- TLSH T1B3C73312D68B9AEDA10DF1B28F574A4F72D58B383CB17A39B44418C1B13F3927685C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/audiodg.exe themida static1/unpack001/taskhost.exe themida static1/unpack001/taskhostw.exe themida static1/unpack001/unsecapp.exe themida - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/audiodg.exe unpack001/taskhost.exe unpack001/taskhostw.exe unpack001/unsecapp.exe
File Explorer
-
para-triage-somente-binarios.zip.zip 54.4MB
-
audiodg.exe.exe 4.5MB
-
taskhost.exe.exe 16.9MB
-
taskhostw.exe.exe 21.0MB
-
unsecapp.exe.exe 13.0MB
audiodg.exe
- SHA256 3f68c47b27c7d7bf247e54e69925221fe9b71efc898929913acc507e926077fa
- MD5 448afa1dcb16847ca7a211cc15ac5239
- SHA1 2bbe7c3778716a56332c6d677b8599d136ddbe17
- SHA512 a3027e260c5e348fbf29d0b67115a8c5b7c20480ba6e1726661f8667bf4b0e6ee10dd24b580c5ffb47410a0bbd67899d9b6fafb8701aafd39a3c2b2f9d392b91
- SSDEEP 98304:OvmSJIy285d8f/jZzcGfK70YBRLuhClKKOHUT78ZQ/Tt6JdP8rMyL65WXHv4glq:OvXf285+/jxcGS70UluiKKOH+I656D8Y
- TLSH T1172633E6CFF479AAD05820723924A23D3BC35F4E9CA44929C65BB54B31146C572FAF0B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
8030360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
382KB
Virtual Size
716KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
59KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
16KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
353KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=21, id=241, version=40116,
count=156, id=243, version=40116,
count=33, id=242, version=40116,
count=1, id=199, version=41118,
count=46, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=557, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
taskhost.exe
- SHA256 71477ac7eef1f3dfeae332aa7bf6c5d9a18c0dab238b2e5d75ba4c4b17cd0985
- MD5 923850d6fc1a6cd693cabf33706db9ec
- SHA1 2d5836fe430fef9b1f67d16b8ef33196c713d17c
- SHA512 1bdbeab18535c9191488c900fe2d5b9a66a3d87e2ff3f684b3660a9ebcb23b7ac4edb6c731518cd67537142fa8dde74808fbdd4739a9b06d1b0bf551a38c18fe
- SSDEEP 393216:dx/MfvNQAtPF1X6IPUB7jBBEXpfdx3z1X:dNGQAtPF16IshjItz1X
- TLSH T1B40733738DB07068C5932C376D32F30F6ADA7496EEB37676C682A70E58E14824CD7985
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
19602256
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
382KB
Virtual Size
716KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
59KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
16KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
13.9MB
Virtual Size
13.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=21, id=241, version=40116,
count=156, id=243, version=40116,
count=33, id=242, version=40116,
count=1, id=199, version=41118,
count=46, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=557, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
taskhostw.exe
- SHA256 459963495bf0c71e1d1654f51e004fc0b3b8c919fd8931571f9b94209cc7389d
- MD5 9cd26569d3b447457d4b397a4eb3f937
- SHA1 6105a80e89b6eada4d2f7c07fcd8ebc95ebeab58
- SHA512 40d05b98ac7da24cc9b96fe18a1b0049d85796b3bd140a80242bc53140bd4f835f474b9673ce420eb96ad166dd84aca5828b94aa296d9ab41ff63f7e37829fa7
- SSDEEP 393216:rJEAMQ1g/E+jmdejUVu5dn9HyLr5A8HVnlBEiFe9kAMGJn28:VEbQ1YRKIUU5CPpcA4nH
- TLSH T1452723B664778A9ED198BF31C1E88EE64CC25CBF06DD12645CBDEE27397830151B628C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
23882664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
382KB
Virtual Size
716KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
59KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
16KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
17.7MB
Virtual Size
17.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
367KB
Virtual Size
367KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=21, id=241, version=40116,
count=156, id=243, version=40116,
count=33, id=242, version=40116,
count=1, id=199, version=41118,
count=46, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=557, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
unsecapp.exe
- SHA256 d30a26d6f6676d700f86db8ff522cccfea285e1272f2dba210cf99c3b676a773
- MD5 f41ac8c7f6f7871848ddb6fb718a15bb
- SHA1 bce00d05c76d0a4eedbd76c2e87fc55c644edac0
- SHA512 62316becb846b12396401fdb79c14ada97495abdd241fe4815c963d6ea315989bc6f283ff68c17cd90e5b62d3ea025770f4883b2b1f387d0dbe2d41a1c541ba6
- SSDEEP 393216:1tRRbwiBgHRrPdMhK8b65too7E/npaP9XIVKmHcIar6:/UiBgHhFMhKRA4E/oV4jwe
- TLSH T108D6335A0C923161CCD0E9F03712E59CB39D8A3AD523C9A6E97FAD1C30B5CD16EA43D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
17464416
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
382KB
Virtual Size
716KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
59KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
761B
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
16KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
7.2MB
Virtual Size
7.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.imports
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=21, id=241, version=40116,
count=156, id=243, version=40116,
count=33, id=242, version=40116,
count=1, id=199, version=41118,
count=46, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=557, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,