Static task
static1
Behavioral task
behavioral1
Sample
f291b68a9b9889a01d736cb0079c8be1e3f576d19ba1f4762cf2302984455bd2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f291b68a9b9889a01d736cb0079c8be1e3f576d19ba1f4762cf2302984455bd2.exe
Resource
win10v2004-20230703-en
General
-
Target
5de4c3c0ce0e241c76fbb11b625c08fb.bin
-
Size
20.5MB
-
MD5
ecf15e29b4dfa5bdf11f090cf6434603
-
SHA1
771dbe45bc73a376a7d85f4d18f87824a5f128bd
-
SHA256
d944562715428d41c6352b7f76febb3829d6e3dbf8dd5b2a2ad72de81d05b6ca
-
SHA512
41fc990f78ac6ae75dcb5e493c6523f2809161c685fa901941470a979f2af24842c8fb06e79da8926313a4b836987bd2620adc7dacbfbff0116ce891c0564cef
-
SSDEEP
393216:Aa4E3C/x7z5NHo8RhelInm92cH0/EWvaGgayunFWsR1DqiVI4YCxbV4B/8yYF:xvGxgy2OaGgaydi1Dqc8Gqe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/f291b68a9b9889a01d736cb0079c8be1e3f576d19ba1f4762cf2302984455bd2.exe
Files
-
5de4c3c0ce0e241c76fbb11b625c08fb.bin.zip
Password: infected
-
f291b68a9b9889a01d736cb0079c8be1e3f576d19ba1f4762cf2302984455bd2.exe.exe windows x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 588KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 163KB - Virtual size: 520KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 35KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
daw Size: - Virtual size: 34.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 19.9MB - Virtual size: 19.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ