Static task
static1
Behavioral task
behavioral1
Sample
WF_Docs_6082013.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
WF_Docs_6082013.exe
Resource
win10v2004-20220812-en
General
-
Target
882185be29e5a62175ed9922117a1916135a5b7a7d70b7193a678a1ff0392334
-
Size
99KB
-
MD5
d1a234d57417fa05184a02e6bc11ffed
-
SHA1
08e1f9de78b90991c700a443b523ac144dbfe8c1
-
SHA256
882185be29e5a62175ed9922117a1916135a5b7a7d70b7193a678a1ff0392334
-
SHA512
de7f658fa4b79bc52326677a13245c0e4254fbbbf8384e9e7b6dd069e70c1f6d4ea015c437943a6e8ca114f90c62aa9f10050bf99eb11071a976e1dc4edf962d
-
SSDEEP
1536:Z+XEKahQRDNUaNCP2xpcmYRO4JcgxMfyEpa2LTBFH1oDB/d1+Jx9apSFVq/duBAr:Z+UKaehNyaWTBmtL2t+4pMGdbgkE+
Malware Config
Signatures
Files
-
882185be29e5a62175ed9922117a1916135a5b7a7d70b7193a678a1ff0392334.zip
-
WF_Docs_6082013.exe.exe windows x86
521c510f936114d63d5e8cdcce67b346
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextVolumeA
CreateSemaphoreA
lstrcmpW
GetConsoleMode
CloseHandle
ReadConsoleA
GetVolumePathNameW
GetStringTypeA
ReleaseSemaphore
FindFirstVolumeA
WaitForMultipleObjects
GetFullPathNameA
HeapCreate
GetFullPathNameA
GetCurrentDirectoryA
GetEnvironmentVariableW
OpenMutexW
CloseHandle
CloseHandle
GetModuleHandleA
GetDiskFreeSpaceW
GetFileAttributesW
GetModuleHandleW
dbghelp
ImageRvaToSection
ImageNtHeader
ImageRvaToVa
FindFileInPath
Sections
.text Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_WRITE
.res Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE