Static task
static1
General
-
Target
Setup_Passwrd_4321.rar
-
Size
4.0MB
-
MD5
616cf08945d22add613c56a5c0d7a29f
-
SHA1
ccde2d79e2b70e98b914c45ac57b97a5f9f94285
-
SHA256
7232a3a18c2c32a2415ebc69f5350e007e4c4bf34aef86e1d81e6937d5b1d16d
-
SHA512
d1860289147f413f9168825d3eeac4ee558053b7942ee5e41ff5b6aa34e2c7375a6ef6041b15ae566af52ade049c58e34118e72b827ce01cf2c8782f7681be22
-
SSDEEP
98304:H/WxM2hE9jodVRJRGXT4WRkyTtUavth2GgzIMIwIFORLWW+iWx0wfbBI:gtVR3GXcQZBvyr8ZsRaWdWuWm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Setup.exe
Files
-
Setup_Passwrd_4321.rar.rar
Password: 4321
-
CXCS/Data.rtf.rtf
-
CXCS/Info.jpg.jpg
-
Read.me.txt
-
Setup.exe.exe windows:6 windows x86
Password: 4321
9b6f3f808f78d81fe0f909afd50d547c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32NextW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
msvcrt
memset
Sections
.text Size: 159KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
[0] Size: 740.1MB - Virtual size: 740.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.#Y, Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.XE| Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Jc[ Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ