Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume7/main_hdd/E_MY_DOCS/etax2012/etax2012.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume7/main_hdd/E_MY_DOCS/etax2012/etax2012.exe
Resource
win10v2004-20230221-en
General
-
Target
CELH0BGSQ2_2023-06-08_11_41_57.zip
-
Size
4.3MB
-
MD5
700cba4c066eb445d119f86db561713b
-
SHA1
1aabc65a578ce39ce46ecb107f256a101822bc3e
-
SHA256
128d4ca1e4e1d4f9d1884e541867164084539799991721602544d957b5eba80f
-
SHA512
0b4247ba57198387afeb58dbed20f308e8f1c6ff5f7400b06a3a2f94de925e52bacdb21a53daca6996a01ebbe34261dcd22ea6efe29482777cb564b756ad11b2
-
SSDEEP
98304:APIDQUiK+1zzBD1GZUoqq67zGp+VqAXgGlTXlQov:HlI3BD1SU/qgG2qmlTX2ov
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume7/main_hdd/E_MY_DOCS/etax2012/etax2012.exe
Files
-
CELH0BGSQ2_2023-06-08_11_41_57.zip.zip
Password: Infected1234
-
Device/HarddiskVolume7/main_hdd/E_MY_DOCS/etax2012/etax2012.exe.exe windows x86
Password: Infected1234
baa93d47220682c04d92f7797d9224ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrcpy
comctl32
InitCommonControls
Sections
Size: 2.7MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 904KB - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
emfyuncb Size: 778KB - Virtual size: 780KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xnusdqyd Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
manifest.json