cost_allocation.zip
- SHA256 6525dccd536a0e70b23dce6cbb1bc0882f2b415196a88ec7bc531fda75a0513c
Behavioral task
behavioral1
Sample
cost_allocation/cost-allocation.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cost_allocation/cost-allocation.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
cost_allocation/사용설명서_v1.4.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target cost_allocation.zip
- Size 42.4MB
- Sample261110-m4rsmsstdz
- SHA256 6525dccd536a0e70b23dce6cbb1bc0882f2b415196a88ec7bc531fda75a0513c
- MD5 e52eb495ed930cbe971d2333ca2b69b1
- SHA1 01685585aba8525fb25ef491d947e1a76c4e6ecd
- SHA512 fd52b4e5a164f2e1293f236ed37053cdbf3427bfe2129cc83401b9afbe129a851cbd18cac22e87759171c557a8c1a4b9ffa1426e7e6b757e62134f98dca1215a
- SSDEEP 786432:rbRa9MgiWWJnYv/kQgfxEiGvlKIau7gqVeCB2oY6MT5bXzkBZ2:vRaCNJnwcrxEiFE7gqVD21rTdzku
- TLSH T11AA733EA69543EA731A957FDF35A5DA32888EE4439E784D9805B93030CD31B9C631E3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Malformed data in PDF
A PDF can contain malformed data to evade detection
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/cost_allocation/cost-allocation.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cost_allocation/cost-allocation.exe
File Explorer
-
cost_allocation.zip.zip 42.4MB
-
cost_allocation/cost-allocation.exe.exe 42.5MB
-
main.pyc5KB
-
cost_allocation/templates/coa_amount.csv28B
-
cost_allocation/templates/cycle.csv31B
-
cost_allocation/templates/mapping.csv24B
-
cost_allocation/templates/pre_allocation.csv28B
-
cost_allocation/사용설명서_v1.4.pdf.pdf 247KB
cost_allocation/cost-allocation.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 b9f76b47f8ff4dc1ef310a5e01641ec9f19f161dbcc2a8ee6a187d27f574d871
- MD5 3f940484eaf15b96707864d51272e721
- SHA1 1547e0551c601a7b194bd06062e687c124e8644f
- SHA512 48f83be3052a59136e9913d098ffc1282c812ca6cabc565d35c17e9e523e82f9d7e8480561ee94886efd3e2aed476fe5cbcff2ae09ae202ef91b29899b31bb36
- SSDEEP 786432:tljSYGC7W8W8QC0OjTNGCgHnoiJ4XVj7zdmF9qJmVViOE4/gweelHD1gBS:XjSYWVC0K4VnoJVnsF9fOOE6Veeh1g
- TLSH T178A733947B5418ABF4DED23CB2A6D813A8927AC52BF7C4D7457244130DA32F4EE35B24
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
main.pyc
- SHA256 77714f4b0c07aef3ad49f8bbe8b2a5a4db4e539e1c1fa1988f7a4c04bdd371c0
- MD5 071a8a3c74fe678df7766a3abe01f61a
- SHA1 167a81da442748630b8550a67c76520a12b74b3b
- SHA512 442940c39449d5f78857ba3961e520e0a5825a78f7eb4090e70f5eeba9ae9aa5289ceebb51baedff4208596a150c7423dc4530fb2b0925ea0d00d373fc07fb73
- SSDEEP 96:vSqhVrh+fl3/fSdPmLK7FY6IDO1vi4/mkzGWmRggUcuCtlRVCUkxOPDNgvk+ewro:v5thgK75t1vakzGWdg/5Pxgvk3wr3ed
- TLSH T10CC1D9AF10148251FF84E0F2C4BA8C84D22BDEFB7965A706354D4AAE5EC6468CF36350
- MD5 SHA1 SHA512 SSDEEP TLSH
cost_allocation/templates/coa_amount.csv
- SHA256 a2e72a5bbe03e6d46df83ab4af8286ed1ecfe52763887916055ef69ed0dca5dc
- MD5 981d4cf9c3ba129c343060807aa9dcc8
- SHA1 228eaffc72b1a2eb6d1a5ca87fd8abcf412fdfce
- SHA512 6f322009175e6310595357fd0ae95182d94caad6fc04cc7ca7666d6d840cb64ee0addfd30ba76c4f12343b2ca36f4abffc89b0a65d803bc1f6aef3fe5ef90d76
- MD5 SHA1 SHA512
cost_allocation/templates/cycle.csv
- SHA256 cf0d9978ef9295b2d2c7ed9e9a928db17297c58c9d020d946e6f57f5f1f7b5ea
- MD5 c8c3eff7024eb5b16cea31e9315e595f
- SHA1 42949a6bea67e553498e1228efd5656cfaf9e46c
- SHA512 5d748d1cb698a2d3450a88d4a1d0b5158e852b69570c465a6b66a50d8a2ab5421fadd57fa364d9b3130b60118ea57b9205287ef71da5ed1d09c3655a9c9daf4e
- MD5 SHA1 SHA512
cost_allocation/templates/mapping.csv
- SHA256 311e3c0e7b75e285c8ceae79d8a9fa8919bf58470f9a48809aee8a6d3fba7e57
- MD5 c9f9c0887ec1a8344d908d500eb22034
- SHA1 c6232606e428190d790f4e1575b0f37f4f77732b
- SHA512 9caa94d3e65777137abbf6d1a8ee44f88e70a0394eebb6a3fdf554291d7d5b2b8e6b4fbf554ee6f20862be97ddd9862db3ef805a82417e55a87cdf168c820493
- MD5 SHA1 SHA512
cost_allocation/templates/pre_allocation.csv
- SHA256 a2e72a5bbe03e6d46df83ab4af8286ed1ecfe52763887916055ef69ed0dca5dc
- MD5 981d4cf9c3ba129c343060807aa9dcc8
- SHA1 228eaffc72b1a2eb6d1a5ca87fd8abcf412fdfce
- SHA512 6f322009175e6310595357fd0ae95182d94caad6fc04cc7ca7666d6d840cb64ee0addfd30ba76c4f12343b2ca36f4abffc89b0a65d803bc1f6aef3fe5ef90d76
- MD5 SHA1 SHA512
cost_allocation/사용설명서_v1.4.pdf
- SHA256 33c5b3caf60c2870bf36233be2d1fa37d163be21c96c74432a9a4746abac7ae7
- MD5 5abdfcaa7f2d916481f3f8d77a849fb1
- SHA1 23d8337645410294fcdd249d9ba5b9a25237648b
- SHA512 4a85285a2c0afd8c5448769ef8d165109e680d1bc9c8fbeed5bf3deff712a1a034ef728c00330b807a6aa48bcceb3852db5d1c4924e693f95dcab9e5dcb184bf
- SSDEEP 6144:zlIG+9Cowoj+SPffW5YU16eNi9Vs4/JOMXJ7hS6vuJSJza45ud2:zr4j+SPW5YUtM9Vs4oijNaBY
- TLSH T1CB441226A00A993CEA42C1617728F2D3A7ADF557C587015F0CF7D0DA66F0B2DD52BAC2
- MD5 SHA1 SHA512 SSDEEP TLSH