Behavioral task
behavioral1
Sample
传-票.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
传-票.exe
Resource
win10v2004-20230220-en
General
-
Target
传-票.7z
-
Size
364KB
-
MD5
f896d04d6cd0a7081d80e9046c63323d
-
SHA1
0237dbb78f8a23e036c61f254d4a233b644b7567
-
SHA256
9a85644666541f7a73d68a0683bc75129d244fedda3733d48e3e0c54bc6c05c3
-
SHA512
dd23ef33ff958eb40abdf96ab527ce306a5131162e884b4872a36dafb8355a6b2a938766ba8d9c3fd512743a2a436b6d79084fcbf5c82e12e64cd15068c4bf53
-
SSDEEP
6144:hNfsUAT0d7zamniovp9nDMFlYRoiM9T2azHmERAdGvn5bFeSJf58IYZJd/fnyC:/nAiamniovp5oYoBZz/RyGvnRFZF5+Pf
Malware Config
Signatures
-
resource yara_rule static1/unpack001/传-票.exe aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/传-票.exe
Files
-
传-票.7z.zip
-
传-票.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 325KB - Virtual size: 900KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 9KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE