Static task
static1
Behavioral task
behavioral1
Sample
29d91da370cebdf78eacf3f5ae596bc934bd01984ec2f8def06734f6cf427ea5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
29d91da370cebdf78eacf3f5ae596bc934bd01984ec2f8def06734f6cf427ea5.exe
Resource
win10v2004-en-20220113
General
-
Target
29d91da370cebdf78eacf3f5ae596bc934bd01984ec2f8def06734f6cf427ea5
-
Size
64KB
-
MD5
41328687d5695fef2b623f9a377387e8
-
SHA1
0c59a21482c1585e30a6593c57452a8ec80fe997
-
SHA256
29d91da370cebdf78eacf3f5ae596bc934bd01984ec2f8def06734f6cf427ea5
-
SHA512
15e220a26f7f2bf1e4c679c7e4b9fd1a03c8ced9826541a3438b4300db90fd077a8427b6cba9a7ac8693e0304d0d1e7558bc7dd7ef4eef2ea4b84619370af9fd
-
SSDEEP
1536:n+4Eb0kxtUTm+magzuG/J4jFcUWzZ7i+:+4nCtUTRczfx4qzZl
Malware Config
Signatures
-
Gozi_rm3 family
Files
-
29d91da370cebdf78eacf3f5ae596bc934bd01984ec2f8def06734f6cf427ea5.exe windows x86
171d575b0b496524be790371f1906d8c
Code Sign
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetModuleHandleA
GetProcessHeap
GetVersionExW
lstrlenW
lstrlenA
HeapAlloc
HeapFree
GetLastError
WaitForSingleObject
CloseHandle
CreateEventA
VirtualProtect
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleW
LoadLibraryW
ntdll
memcpy
memset
RtlUnwind
NtQueryVirtualMemory
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 706B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 512B - Virtual size: 269B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 34KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ