Behavioral task
behavioral1
Sample
eef12d5811dd70782bf19cd787641dc8050a564aa9416588a7873f7a41f98dc6.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
eef12d5811dd70782bf19cd787641dc8050a564aa9416588a7873f7a41f98dc6.exe
Resource
win10v2004-20230703-en
General
-
Target
1507563c31ecaaf29c4b168da58d27f7.bin
-
Size
3.2MB
-
MD5
511ec82aa21754651bdb3403a87554ce
-
SHA1
3e3b35f8436dda55e62a392b8461f56093d18a73
-
SHA256
4979d901dfe95a248431ba5b0e0ab97e4918ae956a0365844d1d43aec2797a5b
-
SHA512
a1f8b89293c0adca21288c1ece42b7b8746c1043c65b0e7a571314f9534ca2133ca447501311064b9e429593942ac04164b9ddb1f1240eaccbc8ee7e59d425ac
-
SSDEEP
49152:WDpjME1FdOpVjxDNv63RDEoC1oIcXXKYakHhMXOKS3rudalODB85gtgP0e:WDmE1FdgVjx4hOcqY1MW36dalOu525e
Malware Config
Signatures
-
resource yara_rule static1/unpack001/eef12d5811dd70782bf19cd787641dc8050a564aa9416588a7873f7a41f98dc6.bin aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/eef12d5811dd70782bf19cd787641dc8050a564aa9416588a7873f7a41f98dc6.bin
Files
-
1507563c31ecaaf29c4b168da58d27f7.bin.zip
Password: infected
-
eef12d5811dd70782bf19cd787641dc8050a564aa9416588a7873f7a41f98dc6.bin.exe windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 12KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 504KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE