Static task
static1
Behavioral task
behavioral1
Sample
ffff.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ffff.exe
Resource
win10v2004-20230220-en
General
-
Target
ffff.exe
-
Size
1.2MB
-
MD5
cd48fe36205911a6a27a84eb7761bc80
-
SHA1
f6a8469453b64e8c162326ae8a4772523b319f82
-
SHA256
e96818760ea636a3e1d90d1bf38fa2f254587462b3dcb4e29113dd34b0903054
-
SHA512
67ca00e34a313a5ad8b9a14843b5fa04e013b1f5e80c0829fcfd17ec05dc528e09aa55f93a379c8492246a03848a073284a747f8dc3a690c1d043197a19b1b80
-
SSDEEP
12288:5cf7T9n4dzWur6RdYVG9Yec/pKSwVm7eW+hPy74N1iN+bBSKuSL3YArbXNmbcWQp:vUYVGzm6FPR9nkre0Ri1ON6Xjls
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ffff.exe
Files
-
ffff.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ