Static task
static1
Behavioral task
behavioral1
Sample
entry_1_0/Operations Let's talk - Week 13.xls.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
entry_1_0/Operations Let's talk - Week 13.xls.exe
Resource
win10v2004-20230915-en
General
-
Target
file_f9c622fc9e0b4cd491a4addc510083e9_2023-10-03_12_21_15_236000.zip
-
Size
794KB
-
MD5
203cfedf9e47d144164fdeda8f5dfc36
-
SHA1
9dc0569832c9def5de61990680663c365ab7f30a
-
SHA256
e4e0a4d9d14417dd948354e530acc08e42181f7212685354dff68e502b54a25c
-
SHA512
e056838796eaceaff8b20f3638f31d783aaefcdb0f04ff3701e25a1e264a4faecb5a6ec5c5c75ae55c74ee7a3223938f9c53b9e1447226c35524f118951973ff
-
SSDEEP
12288:6bYrbjDpq9O3gN5eFAtpG+QQpYQ/544UKV8pzetMNgBQrM/8U3ljSAPh:yYrnDXwHeF8tpS4KpytaggMUU3fh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/entry_1_0/Operations Let's talk - Week 13.xls.exe
Files
-
file_f9c622fc9e0b4cd491a4addc510083e9_2023-10-03_12_21_15_236000.zip.zip
-
entry_1_0/Operations Let's talk - Week 13.xls.exe.exe windows:5 windows x86
18aabd61279e6cec11a74a4209289593
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostname
connect
socket
gethostbyname
bind
getsockname
recv
send
WSAGetLastError
shutdown
closesocket
__WSAFDIsSet
select
htons
inet_addr
inet_ntoa
ntohs
ioctlsocket
setsockopt
WSAStartup
crypt32
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetSubjectCertificateFromStore
CryptMsgGetParam
CryptMsgClose
CryptMsgUpdate
CryptMsgOpenToDecode
CertCloseStore
CryptDecryptMessage
CertOpenStore
CryptSignMessage
CryptEncodeObject
CryptVerifyMessageSignature
CryptVerifyDetachedMessageSignature
CryptEncryptMessage
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertSetCertificateContextProperty
CertNameToStrW
CryptDecodeObject
CertCreateCertificateContext
CryptMsgControl
shlwapi
PathCombineA
SHDeleteKeyA
PathFindExtensionA
wininet
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
kernel32
GetConsoleCP
HeapSize
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetModuleHandleA
FindFirstFileA
FindClose
FindNextFileA
SetErrorMode
ExpandEnvironmentStringsA
CopyFileA
GetModuleFileNameA
WaitForMultipleObjects
CreateThread
GetComputerNameA
Sleep
ExitThread
GetLogicalDriveStringsA
GetDriveTypeA
LocalFree
GetLastError
SystemTimeToFileTime
CompareFileTime
GetConsoleMode
GetSystemTime
GetLocalTime
FileTimeToLocalFileTime
GetTickCount
GetACP
GetOEMCP
FormatMessageA
GetFullPathNameW
GetFullPathNameA
GetCurrentDirectoryA
GetCurrentDirectoryW
GetTempPathW
GetTempPathA
DeleteFileW
DeleteFileA
SetFileAttributesA
SetFileAttributesW
GetFileAttributesA
GetFileAttributesW
CreateFileA
SetFilePointer
CloseHandle
GetFileTime
ReadFile
GetProcessHeap
GetFileSize
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTimeZoneInformation
GetVersionExA
CreateFileW
GetProcAddress
LoadLibraryA
FreeLibrary
RaiseException
HeapAlloc
GetCurrentProcessId
QueryPerformanceCounter
HeapFree
VirtualFree
HeapCreate
SetStdHandle
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
CompareStringA
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
WriteFile
GetCommandLineA
GetStartupInfoA
RtlUnwind
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
user32
DefWindowProcA
TranslateMessage
DispatchMessageA
RegisterClassExA
GetMessageA
GetSysColorBrush
CreateWindowExA
advapi32
CryptDestroyKey
CryptExportKey
CryptGetProvParam
CryptEnumProvidersA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExA
GetUserNameA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
CryptGetUserKey
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 405KB - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 82KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
manifest.json