Static task
static1
Behavioral task
behavioral1
Sample
rankobazx.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
rankobazx.exe
Resource
win10v2004-20230915-en
General
-
Target
rankobazx.zip
-
Size
653KB
-
MD5
6cf400e686da71e0ec7b6fdd24685f21
-
SHA1
e98924033afc9e445d4cb393d7d6bf787691e8cc
-
SHA256
3b5e05dd2c9af7f9cf4a44d67244e0f9feb2f206fbe95a9a8a240619de95ebb4
-
SHA512
8814e37723b49b622b9322c56e12dd81fe1943754968a6ecbeb1fab1b4ecdccf5b9fd630822b1375177628222e832a4ee1070ef0acbb7d868aaa60892ddd42fb
-
SSDEEP
12288:ZxO9bGaNNLbPLG/Dom+149Xl5FXQLEDTHrdTdT+8N202O+Su:ZU9bGa/3GUP49VPXQLEDTHrdT9KP3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/rankobazx.exe
Files
-
rankobazx.zip.zip
Password: infected
-
rankobazx.exe.exe windows:4 windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 695KB - Virtual size: 694KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ