Behavioral task
behavioral1
Sample
ofsFnjYyc24sE.exe
Resource
win7-20231020-en
General
-
Target
f4120b4b3ffb7e6f9137a3f2e152df98722e0c1bbd2f58d508e106ba8677f40d.zip.zip
-
Size
26.9MB
-
MD5
25adf39689033bf812a485385d67b67c
-
SHA1
2d2a2327fe6aed86e88a242977807c8bd4f70a9b
-
SHA256
5b6094a5d9074021bcda928ca2e69dd0e91827f44fee2d2ea121c92eb393605a
-
SHA512
31438ad669dd5dc7c133750d928306697665b5405e14bc0e3a64fb030482826e21e75bcdefa38835ed11d99ba2091cd6810e76fbc9b134b2c1feda929693b3a5
-
SSDEEP
786432:PZNQgfeoJtPNqf/0mzPQz7W/Bwxy2JAgpWtB:gcZJtmQz7WpwTAe2
Malware Config
Signatures
-
resource yara_rule static1/unpack002/ofsFnjYyc24sE.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/ofsFnjYyc24sE.exe
Files
-
f4120b4b3ffb7e6f9137a3f2e152df98722e0c1bbd2f58d508e106ba8677f40d.zip.zip.zip
Password: infected
-
f4120b4b3ffb7e6f9137a3f2e152df98722e0c1bbd2f58d508e106ba8677f40d.zip.zip
-
MBZU/BR.ini
-
MBZU/CN.ini
-
MBZU/EL.ini
-
MBZU/ES.ini
-
MBZU/FN.ini
-
MBZU/Font/VN.dds
-
MBZU/Font/br.ttf
-
MBZU/Font/en.ttf
-
MBZU/Font/kr.otf
-
MBZU/Font/sc.otf
-
MBZU/Font/tr.ttf
-
MBZU/GR.ini
-
MBZU/KR.ini
-
MBZU/PL.ini
-
MBZU/RU.ini
-
MBZU/TUR.ini
-
MBZU/TW.ini
-
MBZU/VN.ini
-
ofsFnjYyc24sE.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 110KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 18KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 5.0MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 11.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ