Static task
static1
Behavioral task
behavioral1
Sample
(ZEPP Transport GmbHPO07960)doc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
(ZEPP Transport GmbHPO07960)doc.exe
Resource
win10v2004-20220812-en
General
-
Target
(ZEPP Transport GmbHPO07960)doc.exe
-
Size
227KB
-
MD5
3c1f57b52d90b7597e57fcd4480f567a
-
SHA1
7bb6056875856d4e22a82a9d98edba7451253a13
-
SHA256
dc35769a749ae7caae46ba23c25c6cf8708a5e702b8dcf7d57fa365c8895d515
-
SHA512
1aa8ab514805df64bb7480a430a750d4744fdd659a5743b6205c9ea6a53645275ba67de3c2019590046fe44c67625ae7f210e2aaa139fb5495aef19d8036dac2
-
SSDEEP
6144:Q42xwMxES6pJRXDXg20zq/FNvkMA93m8h:NMMzTizIF9c93D
Malware Config
Signatures
Files
-
(ZEPP Transport GmbHPO07960)doc.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ