Static task
static1
Behavioral task
behavioral1
Sample
Tzyczbzokc.qPIMoHjl.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Tzyczbzokc.qPIMoHjl.exe
Resource
win10v2004-20230220-en
General
-
Target
Tzyczbzokc.qPIMoHjl.exe.part
-
Size
60KB
-
MD5
0f5dada8db8cad7f4bdb89a9f3b8f946
-
SHA1
0e164e2526448356fe740e9954ec9543eb11a264
-
SHA256
4df1598ddb249304ad10146ba894de8a2b43f2c2f0a360b3ac980cf6d7a88416
-
SHA512
2cc7187cedbe50e0d2f49c1ffdd61f9269002de4d9641b376c39dd2f7ffcd88c40e5e5fdd929925a942302b5029d4469bae092a320f3eb94dc8da4fe08e1e5a9
-
SSDEEP
768:wc1A13KNP7990jKU7xLtgWpGmYP9kfSsJDfQDDCVnoO37KewnD4giSoeR9USj/Yp:aKNP7990jKUVrAts4D4cD4IRFI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Tzyczbzokc.qPIMoHjl.exe.part
Files
-
Tzyczbzokc.qPIMoHjl.exe.part.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 115.6MB - Virtual size: 115.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ