Static task
static1
Behavioral task
behavioral1
Sample
RFQ_TMZ14062020.exe
Resource
win7-20220414-en
General
-
Target
15ac04ec28d56ae025739eb61733b091ce0c6ea9498eca607c07e2f71c702df1
-
Size
194KB
-
MD5
4c14e5f104fe6a299773d4b4399c91c9
-
SHA1
7e1e41e7e29a66c20263c1508b822b2c7675af6a
-
SHA256
15ac04ec28d56ae025739eb61733b091ce0c6ea9498eca607c07e2f71c702df1
-
SHA512
86843e971de5031e57ff1638283171197f00afaa632a6c225c7bc3d39475ee7c620e47957ef5e8259a7a30525ba8499c8d5c969283ff9aebd7bfa593401f3049
-
SSDEEP
3072:I1MbO/MsfRKtwlLFF7mgm+sCTmK1y2RhGg5RlUOY4YmtMPYKxSfjRSxqsyAmM:3GMIRK6lNmXCT5A2RhP/pnMwNlG
Malware Config
Signatures
Files
-
15ac04ec28d56ae025739eb61733b091ce0c6ea9498eca607c07e2f71c702df1.zip
-
RFQ_TMZ14062020.exe.exe windows x86
7bf3276cea36987fb223f1040f855c23
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeConsole
VirtualProtect
DecodePointer
EncodePointer
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
RaiseException
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
RtlUnwind
LoadLibraryW
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
IsProcessorFeaturePresent
user32
GetSystemMetrics
Sections
.text Size: 220KB - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ