Behavioral task
behavioral1
Sample
ex1fk39WJy.exe
Resource
win7-20231023-en
General
-
Target
ba8843987845ffe10f0464941ac3be9da2a10f0c565e02a8de21b9b1c256637b.zip.zip
-
Size
26.6MB
-
MD5
e115ae119771fcad8563caf20bedaf94
-
SHA1
e3cf43cb098c59f97ecddb7c008b7a56d64002f6
-
SHA256
de33a83b53903c96665bc6cbec4447c20a4a4c11f64a6a82adc98053e49ad964
-
SHA512
eb53a0b844f37961443f9f9ae4a48bd94c61c90186d22d40ed7a73d3d3784740f575c4e61af8b152fb6fe6474b296bc328a6b73853c202d54c3a68ecdd831030
-
SSDEEP
393216:J4mayHrTh42rPu9L91gC1Ze0Tx4GFWc1Ov9RXMamxEDDMCjQ4khixvjLVGaACz0U:JHXrdGJ1FhPwG/xEcyQ4kh2DtwS6Sf
Malware Config
Signatures
-
resource yara_rule static1/unpack002/ex1fk39WJy.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/ex1fk39WJy.exe
Files
-
ba8843987845ffe10f0464941ac3be9da2a10f0c565e02a8de21b9b1c256637b.zip.zip.zip
Password: infected
-
ba8843987845ffe10f0464941ac3be9da2a10f0c565e02a8de21b9b1c256637b.zip.zip
-
MBZU/BR.ini
-
MBZU/CN.ini
-
MBZU/EL.ini
-
MBZU/ES.ini
-
MBZU/FN.ini
-
MBZU/Font/VN.dds
-
MBZU/Font/br.ttf
-
MBZU/Font/en.ttf
-
MBZU/Font/kr.otf
-
MBZU/Font/sc.otf
-
MBZU/Font/tr.ttf
-
MBZU/GR.ini
-
MBZU/KR.ini
-
MBZU/PL.ini
-
MBZU/RU.ini
-
MBZU/TUR.ini
-
MBZU/TW.ini
-
MBZU/VN.ini
-
ex1fk39WJy.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 108KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 18KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4.9MB - Virtual size: 9.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 11.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ