SynapseX.zip
- SHA256 4bac0c82a8fcf7cf96dea8e64dfb22252e7fd1c873a7a2f35b411e79e235b545
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SynapseX/SynapseX.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
SynapseX/SynapseX.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
SynapseX/libcurl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
SynapseX/libcurl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target SynapseX.zip
- Size 4.7MB
- Sample261107-ww794aff98
- SHA256 4bac0c82a8fcf7cf96dea8e64dfb22252e7fd1c873a7a2f35b411e79e235b545
- MD5 9b3d2f05cfbfaff7470a929f1001afe6
- SHA1 06f6b8cb416197fc7e144bc69bc69efeaf368e08
- SHA512 a7e92d7dc43d7fb178e5acea838708dc740e8c6dab875aa81bd4a052924047810e221df63dd2a9af9c33987f2098ce5079986c270861229b25eec9385871eb1a
- SSDEEP 98304:GPS87eUXSUaqguwwys6BCEsU0OIZBiduze4TembDDDe8GX:qS+XSUHrwzs2IZBTztTemb6P
- TLSH T1E836331A9CC431C1E1EF86E592CE0B285C34BCA24EA2E69047D5D7BD7B1C578FAE7112
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/SynapseX/libcurl.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SynapseX/SynapseX.exe
File Explorer
-
SynapseX.zip.zip 4.7MB
-
SynapseX/LICENSE7KB
-
SynapseX/Makefile707B
-
SynapseX/SynapseX.exe.exe 8.0MB
-
SynapseX/config.toml303B
-
SynapseX/libcurl.dll.dll 532KB
-
SynapseX/requirements.txt1KB
SynapseX/LICENSE
- SHA256 319917f5ccd09878db6f67c9a77dee846055644ca49eb535628b9e020a87261e
- MD5 8e3494bf8cf1967afd3b1016fbbe5bb0
- SHA1 b1608abb6e19ef60f4b9c52f6e05bf81cc97d0c2
- SHA512 11294efdbf6203801edfc8c4a55e106e80196ae65bb024359c3d105736251be5ed7a5a1e802cb492be112668e1c6a632eca4cbcf9be62775a82adf6e5ecb974e
- SSDEEP 192:HhKdfuB05iy5ylXFln0LxDvvzDyf1/rKpC:4dfsgi6uD0LlPs
- TLSH T11DF1EF6B970153B202E305416E4EA1CEE36AA07B36778D6438A9C25C177BC3493B76ED
- MD5 SHA1 SHA512 SSDEEP TLSH
SynapseX/Makefile
- SHA256 aef2d0eef89302d1117707badc975d6c63ee40df2d27ae4f198bb25138201f46
- MD5 f540dec20889a7dcb32e6aeca5885109
- SHA1 b0867ba9fcdbdff7cec88b37b8405c3553b1579e
- SHA512 08c8391e6842a6c5009230d1d9cb134eacd81958679cf066300a8bf0915374df794f04d5e467b1fdd1cfb2b49cdee51b3ae537ca09f65b3ac64178515420c44a
- TLSH T1DE017B3412C5B6B17A0C4BFCE66B46BDC25FF35B44514341B8819EFA30326833956858
- MD5 SHA1 SHA512 TLSH
SynapseX/SynapseX.exe
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 6c2446f06869a50df82165dbbc78527186cc70e8ebb50c48634de0ab9057c00a
- MD5 53648dee77c997e3665a8c3add00eeaa
- SHA1 dfeedc4eae6c517ef1286bd041cc36de8a608f46
- SHA512 598afff16262ee75f9866a62a124407c6ef5dff8c577371ea79ea8817805be998ba6d0553497400312c1cf5c0106772696727f312bd55ac99a8c23dd6e138f65
- SSDEEP 98304:V3T2h9PPeJzgg3ty1qrMGUjEBoSMeduU8gsHZVY/YK2:VjigJMg3E1qwQFM/U8gsHCYX
- TLSH T1FC867C43EC9159E9C1A9A33089A79253BB71BC481B3223D72B90F7392F76BD06E75350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
506368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.7MB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
300KB
Virtual Size
643KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
479KB
Virtual Size
479KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
775KB
Virtual Size
775KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
456KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/95
Size
188KB
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/112
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
409KB
Virtual Size
409KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
SynapseX/config.toml
- SHA256 8dc716f57504b1a81d926c4793ccfa143a2d83337ae4c4bcb8da106ba90188b0
- MD5 d2fd712eb5eb2cba945d93680208e954
- SHA1 dafdaf15552428fcb54f562593fbb3ca2a42cee9
- SHA512 ab8901575e924295d77a3674319a2feb339ae4a206c4e8a25534c1166a9874552eac9c034b98e101ccb272a2585ffc85d7aaaf2a6608a451d6dce5a7d8a6bfe7
- TLSH T1C9E07DBC438A72612714110764E400E1E3ECBB0C748E8125831C18213E6285CA0EAD19
- MD5 SHA1 SHA512 TLSH
SynapseX/libcurl.dll
- IMPHASH 5358152c0d79f70fd94d03415e08ddbe
- SHA256 79f567797066f6206ea870ffda11cf92612aea0ee3a26582be38ddd0fd51fa53
- MD5 8da7e810e0f12b16fe6087aadda7a69c
- SHA1 e76539074da170bf52a9cc06863ff8cb498c76e6
- SHA512 7d9d40e501c9128cb81af785091aaca60b8b92af57a69f1f498bd810431e3521f9431161f8c3e4061b7e0ba2c3dfc8034e66bc4c05f5e39941623b04d367775d
- SSDEEP 6144:y6NI7/hgoJrPOkFVuW6ZoiPPnk/9AAQIPGBxTShA9ZvT6QKob6LHywHFE1P+wTt4:u/ZhPxVOdk/4IPETvzhHuzE1P+wTt4
- TLSH T1B9C48CA9B7B407B9E5A7C138C5538607E6B2B4651350E7CF43A48B7A2F23BE1163B710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
d7:72:1f:92:20:53:08:c6:de:a0:a9:f2:a3:a6:84:7c:d4:2a:1c:24
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Chains
Feb 14, 2021
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=Notepad\+\+,O=Notepad\+\+,L=Saint Cloud,ST=Ile-de-France,C=FR
Serial Number
01:34:25:92:a0:01:0c:b1:10:9c:11:c0:51:9c:fd:24
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 3, 2019 - May 11, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
288240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ws2_32
ntohl
htonl
gethostname
ioctlsocket
freeaddrinfo
getaddrinfo
sendto
recvfrom
select
__WSAFDIsSet
WSAIoctl
WSASetLastError
socket
setsockopt
getsockopt
getpeername
connect
closesocket
WSACleanup
WSAStartup
ntohs
listen
htons
getsockname
bind
accept
WSAGetLastError
send
recv
wldap32
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord143
advapi32
CryptDestroyHash
CryptGenRandom
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
normaliz
IdnToAscii
crypt32
CertFreeCertificateContext
kernel32
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
HeapReAlloc
FlushFileBuffers
LCMapStringW
CompareStringW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetACP
HeapAlloc
HeapFree
GetConsoleCP
WriteFile
ReadConsoleW
GetConsoleMode
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetEndOfFile
GetFileAttributesExW
GetStringTypeW
GetTimeZoneInformation
HeapSize
WriteConsoleW
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetTickCount64
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
ReadFile
GetLastError
PeekNamedPipe
WaitForMultipleObjects
FreeLibrary
GetProcAddress
SleepEx
SetLastError
FormatMessageA
Sleep
CloseHandle
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
RaiseException
VerifyVersionInfoA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetFilePointerEx
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info
Name
.text
Size
387KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=260, version=25203,
count=6, id=259, version=25203,
count=169, id=261, version=25203,
count=6, id=199, version=41118,
count=7, id=259, version=24123,
count=21, id=261, version=24123,
count=19, id=260, version=24123,
count=13, id=257, version=25203,
count=173, id=1, productName=Unmarked objects,
count=126, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
SynapseX/requirements.txt
- SHA256 1eae2e450eeac1c395f714f2639f09ae83cb959ac09a596151e4cabb9225939e
- MD5 84e1021a2f9073dbacad1349b6c9e4d3
- SHA1 3816f7d813d14dc44449b68479c97dc610eca213
- SHA512 03fb1246f9b9ffab83bc6ab20b9cf0132cc38ac9a80d53459e0bdbaf3037021303c90209aa47bc6f5f53458e30812667f710000216746e39e9224d728a5fe2c3
- TLSH T13921C20112B092736267D2B9C56793909EA3475C55A2E5885BB0B82B17932D257F01DF
- MD5 SHA1 SHA512 TLSH