Static task
static1
Behavioral task
behavioral1
Sample
d2ffeca3621c0b41001e77cf31058790422df840c98e55ed882a0ac1c5568089.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
d2ffeca3621c0b41001e77cf31058790422df840c98e55ed882a0ac1c5568089.exe
Resource
win10v2004-20231023-en
General
-
Target
d2ffeca3621c0b41001e77cf31058790422df840c98e55ed882a0ac1c5568089.exe.zip
-
Size
754KB
-
MD5
a1c05e0a09a7a4ab53351692974dad61
-
SHA1
670bd531037fddc6fb1d9cfe36291cc3a518215c
-
SHA256
f4484a03bc2e406f624180a00285b816280535eeb1d3843125a5a30df22a3f13
-
SHA512
e913ad86d3664d2aaea980e611d70af6c686bcfd869f8d9eb23d5a04932fe25708e261e297804ff42679b10fb0fa0d1f3a9d4e84d8e7d663ef9bc5f7c3703f99
-
SSDEEP
12288:cGeVjUxirGKUSkg2Viub1GgH8p7YdUd3f1YUJrOEqBjl2a6NY3gmy1qhhL7mHs:TJxTLiuxGZNBP1YUJSEqJ84ZhhuM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d2ffeca3621c0b41001e77cf31058790422df840c98e55ed882a0ac1c5568089.exe
Files
-
d2ffeca3621c0b41001e77cf31058790422df840c98e55ed882a0ac1c5568089.exe.zip.zip
Password: infected
-
d2ffeca3621c0b41001e77cf31058790422df840c98e55ed882a0ac1c5568089.exe.exe windows:6 windows x86
e1beb25e9ba6465f9abcbd6c2d69dff7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
wsprintfW
qt5widgets
??1QMenu@@UAE@XZ
qt5gui
??1QPen@@QAE@XZ
qt5network
??1QHostInfo@@QAE@XZ
qt5core
??1QUrl@@QAE@XZ
rpcrt4
UuidCreate
wininet
DeleteUrlCacheEntryW
urlmon
URLDownloadToFileW
sensapi
IsNetworkAlive
ntdll
NtClose
ws2_32
WSAGetLastError
version
VerQueryValueW
winhttp
WinHttpOpen
advapi32
RegEnumKeyW
shell32
CommandLineToArgvW
Sections
.MPRESS1 Size: 717KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 218KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE