Static task
static1
Behavioral task
behavioral1
Sample
9fab4fe1086f37247ca27d6d66a3cbcb72400bf1bbf567665652d41034ecb660.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9fab4fe1086f37247ca27d6d66a3cbcb72400bf1bbf567665652d41034ecb660.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe
Resource
win10v2004-20230220-en
General
-
Target
10397957094.zip
-
Size
1.2MB
-
MD5
292c310e47a8f69c242e8e19700dbd79
-
SHA1
7e50d6488dad5e8ecd3949c85c1089afe3e7b303
-
SHA256
1e7abeab7b40ca56a3f6a8d49cfd86b567bce43b790e01a9d7688789944373fb
-
SHA512
b6e0da385fd6884275912283bb23974bfe48c928200efeec60680de2ecf5bbec1a6c9ec938e59c5e41412763ff7a95dfc7054e41f6d34df4e0da3ce49edd380c
-
SSDEEP
24576:hHfNdnqm1Q4u4GNh8da1nbiXcgdSlTlp3Wg/1+0LXFtt+6MPtehdB4:hHf+m1jTGIdOnbKcgdS1lpPt+6Vttvx4
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/9fab4fe1086f37247ca27d6d66a3cbcb72400bf1bbf567665652d41034ecb660 unpack001/d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98
Files
-
10397957094.zip.zip
Password: infected
-
9fab4fe1086f37247ca27d6d66a3cbcb72400bf1bbf567665652d41034ecb660.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 661KB - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
d2b638bc930015604dbede40dc3cb202e1fbfa8956c6168923e0bc0bfd400d98.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 650KB - Virtual size: 649KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ