Static task
static1
Behavioral task
behavioral1
Sample
P.O #CSCL REF 1198.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
P.O #CSCL REF 1198.exe
Resource
win10v2004-20230220-en
General
-
Target
P.O #CSCL REF 1198.exe
-
Size
618KB
-
MD5
488c6ae6e4a3ad9aa99442fe0000cb75
-
SHA1
1232767b8ff9f2cf75d2f332625d644e55088c28
-
SHA256
cecd0cf9c4fc70ac66d79284d5a4b44da73ba58f23de44a2a00d028ce46facc9
-
SHA512
87acc5e136a59d1b413a854a22c3b677a2c0462550b99b1f0ee0706df1667f859dfcbd64587b90cc28f69517a86c782708123a605500f24b7be4e2d47871d9d6
-
SSDEEP
12288:X+n9snBbMUjEtsiD2+/SFPaNc68l35O5K5hAsBzpn77ngUiN4J+Ts:7BAUIOiHSFADBRsLn7MP4J+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource P.O #CSCL REF 1198.exe
Files
-
P.O #CSCL REF 1198.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 603KB - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ