Static task
static1
Behavioral task
behavioral1
Sample
7c6937e919f92cf606e8a836ef82deec728167590f9c0fe790844c2030b65690.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7c6937e919f92cf606e8a836ef82deec728167590f9c0fe790844c2030b65690.exe
Resource
win10v2004-20230915-en
General
-
Target
7c6937e919f92cf606e8a836ef82deec728167590f9c0fe790844c2030b65690.exe.zip
-
Size
542KB
-
MD5
9bbb517c7d701c46779c803ee254a5de
-
SHA1
6ca46197c7ce1ee35c9c35f1739331d29a8ed0a5
-
SHA256
f4417cf7994e84014da835cd8c94f9481e01e25d055df4f54b6a31c5804d1bbd
-
SHA512
205d9082d8dee48a807351b2d1b5a3bf3588d8439544a90aa835d628ffa148f81ce8f0fc3b7b826fa73e0811441bc94b1b3e36949ccfdea451688b8c42275d66
-
SSDEEP
12288:HXqF/V1I1iy+PRPMeJIKSQwywX9qGdF52I2rQeWlPDYtTwWXNaZSds7o9Ts6gn+G:HX8V6M3JEeyQsbdF52NrdW9YJBNaZSd8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/7c6937e919f92cf606e8a836ef82deec728167590f9c0fe790844c2030b65690.exe
Files
-
7c6937e919f92cf606e8a836ef82deec728167590f9c0fe790844c2030b65690.exe.zip.zip
Password: infected
-
7c6937e919f92cf606e8a836ef82deec728167590f9c0fe790844c2030b65690.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
q h)TD/ Size: 515KB - Virtual size: 514KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ