Static task
static1
Behavioral task
behavioral1
Sample
43c5f4aedc42cf8615a3797a97f9a3524132a13fa07b0dfb42b3d49acc4e429a.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
43c5f4aedc42cf8615a3797a97f9a3524132a13fa07b0dfb42b3d49acc4e429a.exe
Resource
win10v2004-20230703-en
General
-
Target
d31363b6e51c5f08edd6b3682880231d.bin
-
Size
201KB
-
MD5
9a8881111b2259f0a9989de2aa7e4f21
-
SHA1
9a4ed6961f7c21b313944522772e9b9b3ef71bee
-
SHA256
6d053556c92a548e39b51ba55d53b59204ba055ddde4bb833df11d1729490204
-
SHA512
04d44e839762282c7732c235e23bec8406968ff258416ed95a2e5bcde9b56b1040c4a26e0c41b6cb0b4c3cf3174198b0316f638af2b5f72f7b8d810e796019de
-
SSDEEP
6144:AEFTmEZ8PzTEIgxMoY5wYS6aRYMTEOEPGMY:JBmzPzEMoalat4OEa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/43c5f4aedc42cf8615a3797a97f9a3524132a13fa07b0dfb42b3d49acc4e429a.exe
Files
-
d31363b6e51c5f08edd6b3682880231d.bin.zip
Password: infected
-
43c5f4aedc42cf8615a3797a97f9a3524132a13fa07b0dfb42b3d49acc4e429a.exe.exe windows x86
Password: infected
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.text Size: 194KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE