Static task
static1
Behavioral task
behavioral1
Sample
FAX_90928891_1991338.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
FAX_90928891_1991338.exe
Resource
win10v2004-20220812-en
General
-
Target
d61544bc44685bcd29361746999bccc6d8ed8e8b558befd81430e7b77d59c652
-
Size
135KB
-
MD5
73a65fcd48887cbec8ffb97e4395830c
-
SHA1
e0fa7d1512deeadf7c9d5edf20d7e12d0c9138f8
-
SHA256
d61544bc44685bcd29361746999bccc6d8ed8e8b558befd81430e7b77d59c652
-
SHA512
2a1823e6d426b391a27f08d4590c7a213f96763ad71a8d66ffdce6b2b1820385745a37bd80eda91e52527baa5d2b3aaec89ca44bbe2706eccc16d11923f23217
-
SSDEEP
3072:OSWepUi7lraib7s9HVwbLnaaCbSpR4t3k3Eu7Syj1Eqq3UCEGtHPJ1Tt:77lrai9bLnvCbSzcnhQ
Malware Config
Signatures
Files
-
d61544bc44685bcd29361746999bccc6d8ed8e8b558befd81430e7b77d59c652.msg
-
http://a248.g.akamai.net/f/248/528/7d/images.j2.com/emailTemplates/efax_corporate.gif
-
http://a248.g.akamai.net/f/248/528/7d/images.j2.com/emailTemplates/j2Grayscale.gif
-
http://assets.j2global.com/www.efax.com/efax-cms-public/dms/efax/resources/images/misc/j2banner.jpg?av=9W3_
-
http://www.j2global.com
-
http://mail.efax.com
-
http://www.efaxcorporate.com/corp/twa/page/customerSupport
-
-
FAX_90928891_1991338.zip.zip
-
FAX_90928891_1991338.exe.exe windows x86
242fa39e3b1f266c781103537c8f8c9e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
DeleteFileA
TlsGetValue
ResumeThread
VirtualProtectEx
GetPrivateProfileSectionA
GetDriveTypeA
lstrlenA
GetPrivateProfileIntW
FindAtomA
SuspendThread
CreateEventW
GetCurrentThread
DeviceIoControl
GetProcessVersion
DeviceIoControl
HeapFree
GetStringTypeW
LoadLibraryW
GetProcessHeap
SetLastError
CreateEventW
clbcatq
DllGetClassObject
CheckMemoryGates
SetSetupSave
ComPlusMigrate
SetupOpen
ComPlusMigrate
SetupOpen
ComPlusMigrate
CheckMemoryGates
DllGetClassObject
SetupOpen
SetSetupSave
CheckMemoryGates
pdh
PdhGetLogFileSize
PdhAddCounterA
PdhGetLogFileTypeA
PdhCloseLog
Sections
.text Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ