Static task
static1
Behavioral task
behavioral1
Sample
D0A927970E230756281222C063F1A06B4637623794A26.exe
Resource
win7-20220414-en
General
-
Target
D0A927970E230756281222C063F1A06B4637623794A26.exe
-
Size
10.5MB
-
MD5
9e63a0aa4f26539beeccb7180568fc4e
-
SHA1
649f49bfa20647858a8073a9416648b76773cfc5
-
SHA256
d0a927970e230756281222c063f1a06b4637623794a26843381e4de3df3c277f
-
SHA512
a3acd7ec1400ccc482239440450ef8df6719dd29ce6290b9f47764030a4e5b47ceb97ce74c71bb156409848e85ceaa38069d2d4113f4043883ae0a28053a546b
-
SSDEEP
196608:gQGZ+hi7zj9AKm6gUU8gBk6cICteEroXxqwNE+sKsXXgvkec8SKyhzvZjXNDy:gb3GH6YkDInEroXlsKkXgsetWRZNu
Malware Config
Signatures
-
44caliber family
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule sample disable_win_def -
Detects Pyinstaller 1 IoCs
Processes:
resource yara_rule sample pyinstaller
Files
-
D0A927970E230756281222C063F1A06B4637623794A26.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 10.5MB - Virtual size: 10.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ