Static task
static1
Behavioral task
behavioral1
Sample
Knvosgohyf.exe
Resource
win7-20230831-en
General
-
Target
Satın Alma Sorgulama PDF.tgz
-
Size
910KB
-
MD5
04ddbe935f3aa8e098e7abe4432b12be
-
SHA1
c9a138fbbeeb933b83014030a1393e30ccfe895d
-
SHA256
e2857375ae8e24459ac2c06a123f2e13b72b51f2d7203dc1ba1709ff3d944396
-
SHA512
e78a04c6064891e86ffa1c6a337ced601b4ccb4676cbf738d3d820bda0d066f5bf3e173c903cf32e67d4ca800e8ee2b45c205784b789274d9c27f6836fb89745
-
SSDEEP
6144:rYWL2atfpvWdmBsKkifrSgBAA1fRdWqcDoTBAjmI3XCt+YvNQrQYl0hNj:raaLvQmB6ifpB315FB+jm0RiNQuhNj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Knvosgohyf.exe
Files
-
Satın Alma Sorgulama PDF.tgz.gz
-
sample.tar
-
Knvosgohyf.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 525KB - Virtual size: 524KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ