Static task
static1
Behavioral task
behavioral1
Sample
Booking SO_加拿大多倫多_0830_萬運.scr
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Booking SO_加拿大多倫多_0830_萬運.scr
Resource
win10v2004-20230703-en
General
-
Target
Booking SO_加拿大多倫多_0830_萬運.scr
-
Size
550KB
-
MD5
8c9704d419ca9a5a7f3fb7388bcaf61e
-
SHA1
9c99d0f178615463ebaedcf4d032d6ae06b3ebb4
-
SHA256
39332270e15778b5c51e1c2339d67f9d7572d54fe92b53636b39bbbc73f73830
-
SHA512
9ed9951b7a9de4556d9744683853f417919e2412a03db82dea887601f0b703ed077348cc51a65082be283a2be60bef8200cbab4e613c35a19e73547b44d0252c
-
SSDEEP
12288:OWb6DNdh8Z72d1mbTYaMjumpQ5rFDr/gS2jdSJ2e+E5jpediqOh8u:/hZzjxrlrp0dze+MjEiqU8u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Booking SO_加拿大多倫多_0830_萬運.scr
Files
-
Booking SO_加拿大多倫多_0830_萬運.scr.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 547KB - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ