Behavioral task
behavioral1
Sample
t536f0746f287ffe6c9131c.exe
Resource
win7-20230831-en
General
-
Target
t536f0746f287ffe6c9131c.exe
-
Size
386KB
-
MD5
e4d3a1d9c41d306200aa39ee9f718474
-
SHA1
7af7cd1865189d69c94fdb28d38b090d322fb134
-
SHA256
7e2371898d8c9121075812f5b9a57de66e7a11ac686042ac6bf59c07b2ad51a2
-
SHA512
6fa7a52bedf77f2ff42d4042a6d4381003e63b38038062b89b7a69395db1dd2a44ac449036f901dabf2d1aaffef0e463d7c347f5c360bb72d2cc3f932358d186
-
SSDEEP
6144:+2G9h7IouE6yrJTe4nPF9bCGV0fAaxYt:+th7d68e4P+GV0fApt
Malware Config
Extracted
gurcu
https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643
Signatures
-
Gurcu family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource t536f0746f287ffe6c9131c.exe
Files
-
t536f0746f287ffe6c9131c.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 383KB - Virtual size: 382KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ