Static task
static1
Behavioral task
behavioral1
Sample
96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe
Resource
win7-20230831-en
General
-
Target
96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe.zip
-
Size
7.2MB
-
MD5
418f6c4f780c2052c4582f129efb6b5f
-
SHA1
75e4988713130943e24144d09cf692b5dad5c061
-
SHA256
958665f4731b73034150465f71f0741cd3e64958e099ab84487589cafb6e4c5f
-
SHA512
d940c25f28d2e6221234da88ed0caa3e3e7eb61f476a17ec30d7b7fe9ee684a29419c470ea7ecdfe9571b489b8e17eaab34aeecd296d3463c8b79fd919c26012
-
SSDEEP
196608:QTXiwdjvf35nVJcwSKge+bOygd+BgwwzyaACSQ:IX3JbuwSKFj+Bgwkya8Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe
Files
-
96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe.zip.zip
Password: infected
-
96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe.exe windows:6 windows x64
b2fe9aeba9d6710be23fc4a93f730186
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
Imports
kernel32
GetModuleHandleA
GetProcAddress
advapi32
FreeSid
cfgmgr32
CM_Get_Device_IDA
comdlg32
GetOpenFileNameA
crypt32
CertOpenStore
gdi32
LPtoDP
imm32
ImmGetContext
msimg32
AlphaBlend
odbc32
SQLFetch
oleacc
LresultFromObject
oleaut32
VariantCopy
propsys
PropVariantGetInt32Elem
rpcrt4
UuidToStringA
shell32
DragFinish
shlwapi
PathIsUNCA
secur32
LsaFreeReturnBuffer
user32
GetDC
uxtheme
IsAppThemed
version
VerQueryValueA
winmm
mixerOpen
winspool.drv
GetJobA
wintrust
WinVerifyTrust
ws2_32
send
gdiplus
GdipFree
imagehlp
ImageLoad
ole32
DoDragDrop
Sections
.MPRESS1 Size: 6.9MB - Virtual size: 26.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 539KB - Virtual size: 538KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE