Static task
static1
Behavioral task
behavioral1
Sample
decrypted.exe
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
decrypted.exe
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
decrypted.exe
Resource
win10v2004-20230220-en
General
-
Target
decrypted.dat
-
Size
2.9MB
-
MD5
1539346351222e3d23c22256f76dc689
-
SHA1
5ac2a09775185796622cb2945d2800da8063d663
-
SHA256
2b1e1e20aeaf5ab73aa81f75af3618293fcea172c6436b85932d2084a07b0149
-
SHA512
e3c2634aaf00be1f35415f03253b3e27dc05c2f424bf69b9e854336b15ef4ae8e75d3a817c86418920d261a97ba152372ae43e4bd27ad5f7537aa478da53c348
-
SSDEEP
49152:mmULSArgiJEgXgC9cubX+NBLbBIAbslolCDdrUbEE3eV8Dcu8TyFGAU5eBa5:tU7+HuSPLbBIAbslolCDdrX4PU
Malware Config
Signatures
Files
-
decrypted.dat.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ