Behavioral task
behavioral1
Sample
vABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZu7TTYP3pLSKKD5JSFGIyEClBdkRPQMmZSURsSATbEApIUi6.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
vABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZu7TTYP3pLSKKD5JSFGIyEClBdkRPQMmZSURsSATbEApIUi6.dll
Resource
win10v2004-20230220-en
General
-
Target
vABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZu7TTYP3pLSKKD5JSFGIyEClBdkRPQMmZSURsSATbEApIUi6OFEGWpBVHKWUTWdl9HVPCbLGuMLYEyHBIZfJTXH_exnGSnW.dll
-
Size
609KB
-
MD5
cdf24c345a8d32c5dff424aeffc8e623
-
SHA1
ece8aca4a58bda5bb4b163f7412cdfb6cab18ef8
-
SHA256
b612af2ebe45a3865d1d962919351879b86b34a817aad719388c1f98fccb41fa
-
SHA512
e69f74ad460dc68d377da272a58cf76aec198cdc33ef7b17eeb3f317757ba248d02e0ce0a54d196ef9cf62e40a96587600d1369d2b654f91961f0e487e3589be
-
SSDEEP
6144:C5cYNEB7YxA9yP9Wrs7KIpTxza+YIWlSBe8+oUZnBZm25L71:CuqE5Y3PSs7KUza+Yae8+hBZm2p7
Malware Config
Extracted
jupyter
http://146.70.86.142
Signatures
-
Jupyter family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZu7TTYP3pLSKKD5JSFGIyEClBdkRPQMmZSURsSATbEApIUi6OFEGWpBVHKWUTWdl9HVPCbLGuMLYEyHBIZfJTXH_exnGSnW.dll
Files
-
vABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZu7TTYP3pLSKKD5JSFGIyEClBdkRPQMmZSURsSATbEApIUi6OFEGWpBVHKWUTWdl9HVPCbLGuMLYEyHBIZfJTXH_exnGSnW.dll.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 607KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ