Behavioral task
behavioral1
Sample
1hackNova7.40.exe
Resource
win7-20230831-en
General
-
Target
1hackNova7.40.exe
-
Size
227KB
-
MD5
6badeb1e9a87fad28128236eecb46c32
-
SHA1
d89bb6ceff7d56c176147e62e17107815328a625
-
SHA256
e3b085539ea01820a02ac0c6e251e8a4424ee16b6d7b79593e52a63c0d314b84
-
SHA512
e5e92ed460e9b5da48c8100aca7617652bcac2a348042400c380a06cfae4d746c464c4c75fd92542015d6619f83ba7bf51e066ea9d49d412042890e3d2bd0e19
-
SSDEEP
6144:OloZMCrIkd8g+EtXHkv/iD44KANHdmOhqU9va6vhlb8e1mnii:YoZZL+EP84KANHdmOhqU9va6v3g
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1136820974357061754/hMoo-2crRNsWYIIUpDTPVSQrcVffVnsRIWRpah9vG4GAcVLQak5tOzwuT94Ky4ND7lmc
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1hackNova7.40.exe
Files
-
1hackNova7.40.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ