Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Install.exe
Resource
win10v2004-20230220-en
General
-
Target
File_pass1234(2).7z
-
Size
4.9MB
-
MD5
4193d26284e08c86cd9e44102df4ccc4
-
SHA1
6bd8c1500500dbfc1d60017206d60d4001f4d636
-
SHA256
68f74ab71ceb57beaa70841ba56d44f8682e8de573949376b9ffe937e1ba7aec
-
SHA512
dd4ccee1b2709a1ea404033c008e4b27c3972f22904a0cf2f0f5328d39b4e25bb267679bdd99268cb75c2e1519dd34ffe02b8d89811e7f5251d020c9303d2017
-
SSDEEP
98304:d9IGMjJNstjMrgvpuqOHbmE8oY08Qg1uAerSK/bwaihsaz:dW/lN9ro28JbQW/S0jW+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/Install.exe
Files
-
File_pass1234(2).7z.7z
Password: 1234
-
Install.exe.exe windows x86
Password: 1234
71dac11c80b80d1f1b6b3c60718d874a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
CharNextA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateInstance
Sections
.MPRESS1 Size: 4.8MB - Virtual size: 10.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE