Static task
static1
Behavioral task
behavioral1
Sample
bankslip.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bankslip.exe
Resource
win10v2004-20230220-en
General
-
Target
b163d2fe45bd18753af7c07fe7fd07b1.bin
-
Size
708KB
-
MD5
dc79de18744675baa467537941306c3b
-
SHA1
6089e8e9fb5c692b2aa0dcca886292f71605b8e8
-
SHA256
e3a2bb639f709e282a070b07ec9e614476b80ab8ed24717389b29c35ade64745
-
SHA512
fa6042e1fa7474ba9fba4e5d5ecdad799ce6a25c0b7bb2fc6b1228d7ad52138847b180332d3d7c2e6abaddd2445d4d43e8d7ba4c3e661262311ab874e5ac0892
-
SSDEEP
12288:9YYjBhaqCndYTKoe0l+v+ZVNy6KA5vlH1ZRdweFThJODqH5sWG8YYO6hSWv8:9thavdk9ZVcVAVlzjJODqZ1LYYaWU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/bankslip.exe
Files
-
b163d2fe45bd18753af7c07fe7fd07b1.bin.zip
Password: infected
-
4f17ec2dfa8fcc22f637567df50fa859d06c1d2fcbadab0a236fa019d282fc4f.xz.rar
Password: infected
-
bankslip.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 803KB - Virtual size: 802KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ