Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20220812-en
General
-
Target
Adobe_photoshop.rar
-
Size
8.7MB
-
MD5
2d9b07764dd8da992b612c1e4057fc54
-
SHA1
3088e351806c86100054889c60806d116e6e4d55
-
SHA256
30ec00ba50d99d977ffd77690d3e1b89afa7c4aed1ad64da01d0d29820cbae89
-
SHA512
33f753f9dccac7a7dbc47911aa4df23cbe1e04966ecfcf2085a592d2f9e65bcf5097f9981bf0927686024e7fbed1e7083e821190477389ce504ee04353239d8c
-
SSDEEP
196608:87Wt+6x6/II7BlwaPTbKXqTN/PVGOerKZz0bNXQmCZuv:86+68/llfZNnI52aXSI
Malware Config
Signatures
Files
-
Adobe_photoshop.rar.rar
Password: gamesoft
-
README.txt
-
Setup.exe.exe windows x86
Password: gamesoft
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
%4) )Ox Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
datafix/Windows22CKABZ5NM2DOSOT.admx
-
datafix/Windows2JC47NVUM55ONO1Z.admx
-
datafix/Windows5MQX3Q667S753DAR.admx
-
datafix/WindowsADY6R632XHII5S75.admx
-
datafix/WindowsHSVV15Q3V0DZ9V7R.admx
-
datafix/WindowsI37QB1LYHNK7J9M5.admx
-
datafix/WindowsKM4K9A148XI8YKWL.admx
-
datafix/WindowsLMVK054N8NV2Z2Q3.admx
-
datafix/WindowsM7E1O172KD562ZUS.admx
-
datafix/WindowsMFFVHWFUS2YCXD40.admx
-
datafix/WindowsMNM5RH9QIJDF2QJF.admx
-
datafix/WindowsOFC6ZU219IOBDWPD.admx
-
datafix/WindowsQG9OPRZR7RKDTWDX.admx
-
datafix/WindowsXBI88TC8PN4U38GV.admx
-
datafix/helepr/Windows0SPN58YIKSJEBU5Y.admx
-
datafix/helepr/Windows1ZS11KD7DG7VZSZR.admx
-
datafix/helepr/Windows542T1IKE7SKMGHT7.admx
-
datafix/helepr/Windows5HKSBI3YDOXY7YFT.admx
-
datafix/helepr/Windows5RO9Y4AOG9FEM3OD.admx
-
datafix/helepr/Windows7OAXSQ4Y5XQGX3Y3.admx
-
datafix/helepr/WindowsANH6LQ0VXW491UED.admx
-
datafix/helepr/WindowsD71B1REY0XEIO9J1.admx
-
datafix/helepr/WindowsE6N2IKQSE45V9055.admx
-
datafix/helepr/WindowsJFR24OLZ2TBT8NVD.admx
-
datafix/helepr/WindowsPMSBZVBDI1Y6UOIU.admx
-
datafix/helepr/WindowsPQMOZYT6TH5SL8JA.admx
-
datafix/helepr/WindowsSOOFGCT5AYU77MT1.admx
-
datafix/helepr/WindowsUBD8DD1HB6LCEM1Q.admx
-
datafix/helepr/WindowsY8K4IE7JY0HXA662.admx
-
datafix/helepr/WindowsZCUJK1L9G8145N66.admx
-
update/Windows22CKABZ5NM2DOSOT.admx
-
update/Windows2JC47NVUM55ONO1Z.admx
-
update/Windows4QYOXTPZUMY0DSUY.admx
-
update/Windows5MQX3Q667S753DAR.admx
-
update/Windows6ULR6TIAZ54DH7Q5.admx
-
update/Windows8S882MCF6RWJV6VJ.admx
-
update/Windows8ZNM9VYYMJ8HX2LC.admx
-
update/WindowsADY6R632XHII5S75.admx
-
update/WindowsARLG3R44KQLNF0NR.admx
-
update/WindowsDNHBXIDNXJFON6DY.admx
-
update/WindowsHSVV15Q3V0DZ9V7R.admx
-
update/WindowsI37QB1LYHNK7J9M5.admx
-
update/WindowsKM4K9A148XI8YKWL.admx
-
update/WindowsLKNAFD6RVQR2QMND.admx
-
update/WindowsLMVK054N8NV2Z2Q3.admx
-
update/WindowsM7E1O172KD562ZUS.admx
-
update/WindowsMFFVHWFUS2YCXD40.admx
-
update/WindowsMNM5RH9QIJDF2QJF.admx
-
update/WindowsMPZFI66P8NVEJ4W2.admx
-
update/WindowsN0FMEWS29S254KF8.admx
-
update/WindowsOBVK9FTGRBXFZQB0.admx
-
update/WindowsOFC6ZU219IOBDWPD.admx
-
update/WindowsQG9OPRZR7RKDTWDX.admx
-
update/WindowsT57I7X4J8J3CWIFL.admx
-
update/WindowsUKWRKL82VKFMQIJO.admx
-
update/WindowsURQC934047LHV4DF.admx
-
update/WindowsWCDR4NHQ1J3EH8ZJ.admx
-
update/WindowsXBI88TC8PN4U38GV.admx