Static task
static1
Behavioral task
behavioral1
Sample
b1b27e3ce1507ce6e4591d47847faf105a21c712710c07623015be15c29b4ee3.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
b1b27e3ce1507ce6e4591d47847faf105a21c712710c07623015be15c29b4ee3.exe
Resource
win10v2004-20231023-en
General
-
Target
b1b27e3ce1507ce6e4591d47847faf105a21c712710c07623015be15c29b4ee3.exe.zip
-
Size
3.0MB
-
MD5
b6a55fb655300757021a05fb75080949
-
SHA1
cb096e6eeaa3a36acf9ed7ed97139db16cc77ed3
-
SHA256
024fc2e1358340550061a1f15b356624f3ef687dc78fb8b222615a74a93dda3f
-
SHA512
2705b186799f7bf372eb0dce68ba788230dd636a86c8a443230da7e8dd420661bf384e62367e7869a6ea3df905d6235e88bf2d1abfa82a4b67d45b22e41012e1
-
SSDEEP
98304:cjB85kUqSJbN6kUgDb5FGu6RHBa+DLOn/:QqlpdUkUgDb5FGbRA+Dyn/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b1b27e3ce1507ce6e4591d47847faf105a21c712710c07623015be15c29b4ee3.exe
Files
-
b1b27e3ce1507ce6e4591d47847faf105a21c712710c07623015be15c29b4ee3.exe.zip.zip
Password: infected
-
b1b27e3ce1507ce6e4591d47847faf105a21c712710c07623015be15c29b4ee3.exe.exe windows:5 windows x64
cfd25bb8b565beae8243cdfa604fadc6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
powerdatarecoverycore
??1KMemoryPool@@UEAA@XZ
ikernel
klog_log
qt5core
?qrand@@YAHXZ
qt5gui
??1QPen@@QEAA@XZ
qt5widgets
??1QMenu@@UEAA@XZ
qt5network
??1QSslError@@QEAA@XZ
user32
GetDC
gdi32
DeleteDC
advapi32
RegCloseKey
shell32
ord155
ole32
OleRun
oleaut32
VariantClear
msvcr120
rand
msvcp120
?_BADOFF@std@@3_JB
propsys
PSGetPropertyKeyFromName
mpr
WNetCloseEnum
libeay32
ord340
libcurl
curl_easy_init
Sections
.MPRESS1 Size: 2.9MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE