Static task
static1
Behavioral task
behavioral1
Sample
5a642b75323299d80fb0e1626b8caed162421e60bf95a71d0e5a4c518e60eb4f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
5a642b75323299d80fb0e1626b8caed162421e60bf95a71d0e5a4c518e60eb4f.exe
Resource
win10v2004-20231023-en
General
-
Target
5a642b75323299d80fb0e1626b8caed162421e60bf95a71d0e5a4c518e60eb4f.exe.zip
-
Size
3.0MB
-
MD5
f8ac945d048b3a651f47bd00430b1eeb
-
SHA1
c332f582452b970837e757631c381553b5d59fed
-
SHA256
6c6b66e969e6fe21c9959be7db0b2dd7f09be099cdb13bc09938f1bfd3de081a
-
SHA512
63e348c9366948ec671dfff4e037bf94101ae6854305e425a2e998a6b8f98c5b24365d519ecdd1a4372f573ada8f7f8437280a69f0035620f9fc48887b094895
-
SSDEEP
98304:tfzqWz2dyoSyEW6CxyP2IAYnbHGVyi4kYK57k:thz2dyq6CxyP2I/nbH4yiY/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/5a642b75323299d80fb0e1626b8caed162421e60bf95a71d0e5a4c518e60eb4f.exe
Files
-
5a642b75323299d80fb0e1626b8caed162421e60bf95a71d0e5a4c518e60eb4f.exe.zip.zip
Password: infected
-
5a642b75323299d80fb0e1626b8caed162421e60bf95a71d0e5a4c518e60eb4f.exe.exe windows:5 windows x64
cfd25bb8b565beae8243cdfa604fadc6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
powerdatarecoverycore
??1KMemoryPool@@UEAA@XZ
ikernel
klog_log
qt5core
?qrand@@YAHXZ
qt5gui
??1QPen@@QEAA@XZ
qt5widgets
??1QMenu@@UEAA@XZ
qt5network
??1QSslError@@QEAA@XZ
user32
GetDC
gdi32
DeleteDC
advapi32
RegCloseKey
shell32
ord155
ole32
OleRun
oleaut32
VariantClear
msvcr120
rand
msvcp120
?_BADOFF@std@@3_JB
propsys
PSGetPropertyKeyFromName
mpr
WNetCloseEnum
libeay32
ord340
libcurl
curl_easy_init
Sections
.MPRESS1 Size: 2.9MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE