Static task
static1
Behavioral task
behavioral1
Sample
Vhycf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Vhycf.exe
Resource
win10v2004-20230915-en
General
-
Target
mkpub_Hesap hareketleriniz pdf.gz
-
Size
139KB
-
MD5
e5669ee3a1bc850edc78f821bcd237eb
-
SHA1
17080715c880c8ff2f299bbab53ba3c43db88afd
-
SHA256
2a0e4da0e8eaed6087098d2a69e25e95c3d8011d3169188ad1b2396728c42f11
-
SHA512
40ca72d5cd1a07702f7f62227ff200e7b361f30e8c8e3b0d65845835349018c990c351b1c5d633d40cbd9863a1acab8a9d31822dfae6565f4e97d12b692eebaf
-
SSDEEP
3072:gYXXwgonCPOlW4kbiv/K/t5I+sJ/Fio11H/twRkb+CY:dXXsCYFk2aV5bsCo1dqRkb8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vhycf.exe
Files
-
mkpub_Hesap hareketleriniz pdf.gz.zip
Password: infected
-
Vhycf.exe.exe windows:4 windows x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 318KB - Virtual size: 318KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ