Static task
static1
Behavioral task
behavioral1
Sample
6e4fa5f776b899d3d3d0cc1da69ff6165aefafd46f70ddb55399c73ba6f965cd.exe
Resource
win7-20230831-en
General
-
Target
11998669374.zip
-
Size
300KB
-
MD5
29f487e3f734190c8672209bcf997e29
-
SHA1
3c215e27531308edd9c02ab4d8315ee2e45a770f
-
SHA256
9b1db1e91a89dbca9fd67f2796c1fd46111381a98c661382a25186d0c870bfde
-
SHA512
63b715c6d3acc2f794aa729c8de2a52d7aea38a5f793fc944528795d25442d95834397748b4091a872a61f71138352a536d2668d7631852c6f5314ca34e1cc84
-
SSDEEP
6144:ZX31Uo70eSC2C5tD/IO4nGex3HnA4UmxmVQs3TqSbggcwy0tPtzvyoa:Z31SqxXD/CnPNHzHxmz32puy0tFzvla
Malware Config
Signatures
-
Nirsoft 1 IoCs
Processes:
resource yara_rule static1/unpack001/6e4fa5f776b899d3d3d0cc1da69ff6165aefafd46f70ddb55399c73ba6f965cd Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule static1/unpack001/6e4fa5f776b899d3d3d0cc1da69ff6165aefafd46f70ddb55399c73ba6f965cd MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule static1/unpack001/6e4fa5f776b899d3d3d0cc1da69ff6165aefafd46f70ddb55399c73ba6f965cd WebBrowserPassView -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/6e4fa5f776b899d3d3d0cc1da69ff6165aefafd46f70ddb55399c73ba6f965cd
Files
-
11998669374.zip.zip
Password: infected
-
6e4fa5f776b899d3d3d0cc1da69ff6165aefafd46f70ddb55399c73ba6f965cd.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 500KB - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ