Behavioral task
behavioral1
Sample
856ce5a32f99dc3f289d214f344adcfa5acf7f2c9f7db5cf38317d19a9504361.exe
Resource
win7-20230220-en
General
-
Target
856ce5a32f99dc3f289d214f344adcfa5acf7f2c9f7db5cf38317d19a9504361.exe
-
Size
467KB
-
MD5
fde7a1d1f68a13c0d1849883f343f163
-
SHA1
ad1b77edb947c0ab74ce9cba7e01f633b03dac1b
-
SHA256
856ce5a32f99dc3f289d214f344adcfa5acf7f2c9f7db5cf38317d19a9504361
-
SHA512
375de2d72eda8dfa8b4351e6b6866e5e77893fddbd6fe3b2eff441ddff5e7ca8fe935d8299c5da8f7aefb45e6abfccc03be1d981226109c559d504fc478e7603
-
SSDEEP
6144:RXVUvr+eNVx6JuGD5To83sRnymABKtqulRwOJfZJEfcZdC48hAiWsAOZZ8RX7mck:RX8/Vx65HCnDAByqulR1fZJQGs/Z8
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 856ce5a32f99dc3f289d214f344adcfa5acf7f2c9f7db5cf38317d19a9504361.exe
Files
-
856ce5a32f99dc3f289d214f344adcfa5acf7f2c9f7db5cf38317d19a9504361.exe.exe windows x86
bd51a645a9c68bd03b2e51586e5cbdcb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
LoadLibraryA
Sections
.text Size: 465KB - Virtual size: 496KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE