Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20221111-en
General
-
Target
Adobe_photoshop.rar
-
Size
2.3MB
-
MD5
4eb4096477edbc5c2f0e92c80ed6225c
-
SHA1
499adb315bb3bd2d89bb871120fa7d75b944c856
-
SHA256
94989586ea99afe3d1e02a8f3c5c832d38eba7b02be5a63c6a40f1c742c9e060
-
SHA512
a8eb612f66fe458e456d23f3df036079c0901cd771ec0a655fba4a426211e29a5eba4526cda7de6406b6951e8827d8725303dbe8b4868345c8920b7129959ba6
-
SSDEEP
49152:/jxVaAI8hxpVlHMY+XNDdeL6Wv5zUQu47GLHTNoZmGb9N:tVltVlHR+pdeLDxuWGPnGJN
Malware Config
Signatures
Files
-
Adobe_photoshop.rar.rar
Password: gamesoft
-
README.txt
-
Setup.exe.exe windows x86
Password: gamesoft
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
9r\U@yk Size: 917KB - Virtual size: 916KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
datafix/Windows22CKABZ5NM2DOSOT.admx
-
datafix/Windows2JC47NVUM55ONO1Z.admx
-
datafix/Windows5MQX3Q667S753DAR.admx
-
datafix/WindowsADY6R632XHII5S75.admx
-
datafix/WindowsHSVV15Q3V0DZ9V7R.admx
-
datafix/WindowsI37QB1LYHNK7J9M5.admx
-
datafix/WindowsKM4K9A148XI8YKWL.admx
-
datafix/WindowsLMVK054N8NV2Z2Q3.admx
-
datafix/WindowsM7E1O172KD562ZUS.admx
-
datafix/WindowsMFFVHWFUS2YCXD40.admx
-
datafix/WindowsMNM5RH9QIJDF2QJF.admx
-
datafix/WindowsOFC6ZU219IOBDWPD.admx
-
datafix/WindowsQG9OPRZR7RKDTWDX.admx
-
datafix/WindowsXBI88TC8PN4U38GV.admx
-
datafix/helepr/Windows0SPN58YIKSJEBU5Y.admx
-
datafix/helepr/Windows1ZS11KD7DG7VZSZR.admx
-
datafix/helepr/Windows542T1IKE7SKMGHT7.admx
-
datafix/helepr/Windows5HKSBI3YDOXY7YFT.admx
-
datafix/helepr/Windows5RO9Y4AOG9FEM3OD.admx
-
datafix/helepr/Windows7OAXSQ4Y5XQGX3Y3.admx
-
datafix/helepr/WindowsANH6LQ0VXW491UED.admx
-
datafix/helepr/WindowsD71B1REY0XEIO9J1.admx
-
datafix/helepr/WindowsE6N2IKQSE45V9055.admx
-
datafix/helepr/WindowsJFR24OLZ2TBT8NVD.admx
-
datafix/helepr/WindowsPMSBZVBDI1Y6UOIU.admx
-
datafix/helepr/WindowsPQMOZYT6TH5SL8JA.admx
-
datafix/helepr/WindowsSOOFGCT5AYU77MT1.admx
-
datafix/helepr/WindowsUBD8DD1HB6LCEM1Q.admx
-
datafix/helepr/WindowsY8K4IE7JY0HXA662.admx
-
datafix/helepr/WindowsZCUJK1L9G8145N66.admx
-
update/Windows22CKABZ5NM2DOSOT.admx
-
update/Windows2JC47NVUM55ONO1Z.admx
-
update/Windows4QYOXTPZUMY0DSUY.admx
-
update/Windows5MQX3Q667S753DAR.admx
-
update/Windows6ULR6TIAZ54DH7Q5.admx
-
update/Windows8S882MCF6RWJV6VJ.admx
-
update/Windows8ZNM9VYYMJ8HX2LC.admx
-
update/WindowsADY6R632XHII5S75.admx
-
update/WindowsARLG3R44KQLNF0NR.admx
-
update/WindowsDNHBXIDNXJFON6DY.admx
-
update/WindowsHSVV15Q3V0DZ9V7R.admx
-
update/WindowsI37QB1LYHNK7J9M5.admx
-
update/WindowsKM4K9A148XI8YKWL.admx
-
update/WindowsLKNAFD6RVQR2QMND.admx
-
update/WindowsLMVK054N8NV2Z2Q3.admx
-
update/WindowsM7E1O172KD562ZUS.admx
-
update/WindowsMFFVHWFUS2YCXD40.admx
-
update/WindowsMNM5RH9QIJDF2QJF.admx
-
update/WindowsMPZFI66P8NVEJ4W2.admx
-
update/WindowsN0FMEWS29S254KF8.admx
-
update/WindowsOBVK9FTGRBXFZQB0.admx
-
update/WindowsOFC6ZU219IOBDWPD.admx
-
update/WindowsQG9OPRZR7RKDTWDX.admx
-
update/WindowsT57I7X4J8J3CWIFL.admx
-
update/WindowsUKWRKL82VKFMQIJO.admx
-
update/WindowsURQC934047LHV4DF.admx
-
update/WindowsWCDR4NHQ1J3EH8ZJ.admx
-
update/WindowsXBI88TC8PN4U38GV.admx