Static task
static1
Behavioral task
behavioral1
Sample
13f2b27d37130476afbe8c193cac37eb05601a294f978ed052954a30fe8faa22.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
13f2b27d37130476afbe8c193cac37eb05601a294f978ed052954a30fe8faa22.exe
Resource
win10v2004-20230915-en
General
-
Target
5ffc02ba71ebf79f0a3af47a525f6c07.bin
-
Size
517KB
-
MD5
3e9be8d6b99af55978c3a95103e1c663
-
SHA1
bb06da532b41bc0ea4919c0c6d4cc9eca59d9f43
-
SHA256
e438632001dcb86dbe1a1c1761616c2cccaa16e1d5feaaeb8af21c5f97fb7f04
-
SHA512
fb898b19a2da84b0906ab59f054dd64a0f6573290ce3d6b7e0e1d047670df7b43369bb971d05bbe9f88e2d6402d6ca4560abbd7504f2eedd31abcf3a4c08b149
-
SSDEEP
12288:zN4FbdfqnfoXEHEEE+8v2uHxOuH8rBCK7WVf+nT:zOqQXqNIxOuH8h7dT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/13f2b27d37130476afbe8c193cac37eb05601a294f978ed052954a30fe8faa22.exe
Files
-
5ffc02ba71ebf79f0a3af47a525f6c07.bin.zip
Password: infected
-
13f2b27d37130476afbe8c193cac37eb05601a294f978ed052954a30fe8faa22.exe.exe windows x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 551KB - Virtual size: 550KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ