Static task
static1
Behavioral task
behavioral1
Sample
INS Rem CrdT TT copy.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
INS Rem CrdT TT copy.exe
Resource
win10v2004-20230220-en
General
-
Target
f501bd428377b0409f3c19b0be19643c.bin
-
Size
525KB
-
MD5
884a14f379e87d94338044b87b8594a6
-
SHA1
6069432824b49d58c1a5064c71fea268faf76268
-
SHA256
1a8a3061f60e25ceb34d8196955f9f50781f81238d013ec30088f7730aa6955f
-
SHA512
85193a608d93ff3050b5f7e4d35447cbbb43fdab3f7533ea10cda754f89c134d8360ff72e180e968aa987d6f9499d574885545ff298138ea80a9f29e1b4bc43c
-
SSDEEP
12288:6c6Vx6cY1wq0qJ82N26uc5AvUe4sxV22qa57RS2PinzLSujgSRb4p+X:6vVxE1wq0qJfxP64x2x57bPinSrS2u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/INS Rem CrdT TT copy.exe
Files
-
f501bd428377b0409f3c19b0be19643c.bin.zip
Password: infected
-
70d07397898f5f1ff1151749648c1208019f139a4f2a242a0e5759a4a8b5c8fe.rar.rar
-
INS Rem CrdT TT copy.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 678KB - Virtual size: 677KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ