Behavioral task
behavioral1
Sample
Nicht bestätigt 177900.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Nicht bestätigt 177900.exe
Resource
win10v2004-20230824-en
General
-
Target
Nicht bestätigt 177900.crdownload.zip
-
Size
1.3MB
-
MD5
b812548028e5611f1478a8375f853dba
-
SHA1
84510ee67048ad1832e067e6b70337b26e20deef
-
SHA256
ab218911b67398384e40e3dd79131fe6fd7279b7a9a60ab1f19dbb1bb9535a12
-
SHA512
640af6d7dd3df70890cd7bcb6ff10a54dcd464f37f2fc7b2124c7dea27f9e3394a1cab119b88faa725a798baef6daca35371eed523c25dbbd7ae377e3db9381c
-
SSDEEP
24576:zsan5bHVP45mD1UxsJb4PsATGHewaq9coB/aZfYULg51wT9Mt2:zrNSrKCQH7vmYU0XqF
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Nicht bestätigt 177900.crdownload upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nicht bestätigt 177900.crdownload
Files
-
Nicht bestätigt 177900.crdownload.zip.zip
Password: infected
-
Nicht bestätigt 177900.crdownload.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 256KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 195KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE