Behavioral task
behavioral1
Sample
aed6211697eeb8c29dc36d7dcf092093057ffa5ef9e7838a9312147fc68f4f55.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
aed6211697eeb8c29dc36d7dcf092093057ffa5ef9e7838a9312147fc68f4f55.exe
Resource
win10v2004-20230915-en
General
-
Target
5644358bddb526e022b8fcbd4ecbf88d.bin
-
Size
83KB
-
MD5
388def02b3df135d42d71df81af143ec
-
SHA1
e6e38f864f3139f407000cdb266e8c1d455cc16a
-
SHA256
d2b981e48aac86486a1835bd13411e2a1e6f6cfdea01aaf4408be6f9721d0ab9
-
SHA512
68ffd64114d8cb9e5c0528f1a201917286267ecfcf115695242a92f06b46f9f481d362c90ed9a7dedbf1ecef3167c9cd81da0e1f70cdfb940e0cf96aebd590a3
-
SSDEEP
1536:UUGHRquSf4ILEIG5jQv3jDjDdpyQ1p+i8wyPDx3ikN8hFVAo8y7oC0ATYg:U/xq4ubXp+iEDxDC0oMg
Malware Config
Signatures
-
resource yara_rule static1/unpack001/aed6211697eeb8c29dc36d7dcf092093057ffa5ef9e7838a9312147fc68f4f55.bin aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/aed6211697eeb8c29dc36d7dcf092093057ffa5ef9e7838a9312147fc68f4f55.bin
Files
-
5644358bddb526e022b8fcbd4ecbf88d.bin.zip
Password: infected
-
aed6211697eeb8c29dc36d7dcf092093057ffa5ef9e7838a9312147fc68f4f55.bin.exe windows x86
Password: infected
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 324KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 78KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE