Static task
static1
Behavioral task
behavioral1
Sample
千方医保前置机更新程序.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
千方医保前置机更新程序.exe
Resource
win10v2004-20230220-en
General
-
Target
千方医保前置机更新程序.exe
-
Size
51KB
-
MD5
56106a3b61293966b2b5b854aaf24f10
-
SHA1
e70470c6e0a4e39adde4582f50023da049117662
-
SHA256
e9cc3351a059a73f2710a02a05c64589ab40a7eff86126aba1f4b6e4e2d87039
-
SHA512
b2293fc7e485f0d891fccfcf3cf9ff2f91d8f0d64dfd7b3d5f8fd3b234751a4e92fba1ceeee48b0cc4b16ce09de176e690c5fcfb18ab0f9052f42ed5ec5f9d35
-
SSDEEP
768:wXYdUURqhe7Ic3pQgx8wQvVqQmlaNdXoKgXZbLoRqhe7Ic3pQgx8wQvVqQ:wWxZ1PQvVqQiIdXohXZ3CxZ1PQvVqQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 千方医保前置机更新程序.exe
Files
-
千方医保前置机更新程序.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ