Static task
static1
Behavioral task
behavioral1
Sample
e0b6cd5d1fde1430ff0a72e7e5a3716ab954ce2a2817547f69b472b3ee6ae9c3.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
e0b6cd5d1fde1430ff0a72e7e5a3716ab954ce2a2817547f69b472b3ee6ae9c3.exe
Resource
win10v2004-20231020-en
General
-
Target
7d27d12925be5a5aab8f895f210103ae.bin
-
Size
201KB
-
MD5
573128e55aeb3cae82cbef63c190ac45
-
SHA1
00164b08f90496a07de0dd81a79758e6f4eebee0
-
SHA256
9b02c447b689f709843223910cd38669f4c554c6c28f2698114a90a6ab573085
-
SHA512
d74e043036c5549fc625282a719247ace4472c934a2c0b587057fb40a63bf89af179fe7975752ea8de0469046490f092878d46f3ab76dc64b912cc47684e1875
-
SSDEEP
6144:VbUCTaEWviU0XEahRtiUrIb7cBNAONlQQY:VbPTaEWaU0XEVUkb7cBLlnY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e0b6cd5d1fde1430ff0a72e7e5a3716ab954ce2a2817547f69b472b3ee6ae9c3.exe
Files
-
7d27d12925be5a5aab8f895f210103ae.bin.zip
Password: infected
-
e0b6cd5d1fde1430ff0a72e7e5a3716ab954ce2a2817547f69b472b3ee6ae9c3.exe.exe windows:5 windows x86
Password: infected
1eca5643b089b9e9112d847d0e45f8ac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
DrawIcon
gdi32
BitBlt
advapi32
RegCloseKey
shell32
ExtractIconA
ole32
CoGetObject
shlwapi
StrToIntA
winmm
waveInOpen
ws2_32
gethostbyname
urlmon
URLDownloadToFileW
gdiplus
GdipFree
wininet
InternetOpenW
Sections
.MPRESS1 Size: 195KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE