Static task
static1
Behavioral task
behavioral1
Sample
PRE ALERT DOCUMENTS.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PRE ALERT DOCUMENTS.exe
Resource
win10v2004-20230221-en
General
-
Target
01cadc2bafe4bee8752d0913507505be.bin
-
Size
433KB
-
MD5
790e489174ca3371125c9e388e751e46
-
SHA1
eef7c8e1310f7b3abb63844a4b9398cbb43b1d09
-
SHA256
418238cb67647b1d54ecb258e6ddf7e1b9de43e2401610948a1c673246f3e255
-
SHA512
e6890e4c50c64fc132ba394da80b503016a3fb463fa915aca570b5165c5e0f0efd519e4657d2a43be4a7f5398dd2b28a55c31ce0aa8c74e20d445a7c684f1354
-
SSDEEP
12288:1ZWZeyLXuS0C35DdUvI6zr1jj78cW221hFHv1hTXoLOUQORF:1ZWoy6S0Cd2I6zr1jHilhzQVQG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/PRE ALERT DOCUMENTS.exe
Files
-
01cadc2bafe4bee8752d0913507505be.bin.zip
Password: infected
-
f750e50ad22a7171a24c23ee2879d2920d820fd5547f65da6bc15bc900d2119b.rar.rar
Password: infected
-
PRE ALERT DOCUMENTS.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 852KB - Virtual size: 851KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ