Static task
static1
Behavioral task
behavioral1
Sample
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
Resource
win10v2004-20230220-en
General
-
Target
13dc441ec2f9e3f9aa1f354a4b14d318.bin
-
Size
1.3MB
-
MD5
3857b5e1ba6b525d71f07d944f1eb6b4
-
SHA1
d0a388e4e6f82d6d771f6fdab6243cd8e2cdb469
-
SHA256
85025d82417b78241eb3e406ed633597911e1b73ae5f712f03ee18f60b16324b
-
SHA512
5cda305dc3008cda5618bb1ca31c8424fe32dff60287f7ca40bcb2a0067da57904a904d9506444305fcc691cfd1e67ddf5e52a310159bb0fc3b1b593e6243028
-
SSDEEP
24576:gWyN3kZKFiKafxovUBqsGW9uKaXFff3myqMzu/3mGlhcOEa/CnV+5AInLkV:gTFYlqD4Cf/9u2GncOxquAInLkV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe
Files
-
13dc441ec2f9e3f9aa1f354a4b14d318.bin.zip
Password: infected
-
6f35bb0a7644cfda2468e984269f7febafcb672591a887a8029257dea0801a7c.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ