Static task
static1
Behavioral task
behavioral1
Sample
LadonExp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
LadonExp.exe
Resource
win10v2004-20230221-en
General
-
Target
LadonExp.exe
-
Size
370KB
-
MD5
368d53227333c65c9e0b5725e85eb7b2
-
SHA1
49a00c0fe2581eff6676651506c809384983f716
-
SHA256
1acb70177cad67f55bcfd0cf06a7790a25891ff1ebc4d5600dade88c71fb76e8
-
SHA512
3cf1024684b30c0d873151d563d05675f4fc98af56fb57839649a4e7d86920b1f8a8997aa51741d8d64c6c3fb940bce62575fafd37c2588479f56ad37c338abd
-
SSDEEP
3072:BO8jzn/32wRNHah8V5pAvWb+N+Tah8V5pAvWF:BO8jzn/32wfHw/W/w/W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource LadonExp.exe
Files
-
LadonExp.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
D8vdd&" Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 309KB - Virtual size: 309KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ