Static task
static1
Behavioral task
behavioral1
Sample
28c6469d7ebbc79e7509d7fc3f4d8a3389c4a79369ccf8ed1b71d55967879c90.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
28c6469d7ebbc79e7509d7fc3f4d8a3389c4a79369ccf8ed1b71d55967879c90.exe
Resource
win10v2004-20231020-en
General
-
Target
28c6469d7ebbc79e7509d7fc3f4d8a3389c4a79369ccf8ed1b71d55967879c90.zip
-
Size
5KB
-
MD5
6194c5c534c337653bfbfb5a5719f68b
-
SHA1
66852f19390dae37c19b022ca5e337be9e0aa7a6
-
SHA256
f03ef9b862650acbdb61e6950f93416a36c5155046d9333661665398dab7fd16
-
SHA512
b5115c34a267a9c6470ba03529a591a1bd7eed59ae46f692f0371ee087c0c26281148f73e220175670fe4cf658a03e572d66304ba0300af655aa30ec86acab6c
-
SSDEEP
96:hfXzm3zTjPDzzPmtL3RsuFVlT2NWZAIgXeMKaPuHA7NlCSuHbAb7+CAERqdb0XVs:hPzW7PDzzPmtL3RfC+APOMdPSALC7MtI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/28c6469d7ebbc79e7509d7fc3f4d8a3389c4a79369ccf8ed1b71d55967879c90
Files
-
28c6469d7ebbc79e7509d7fc3f4d8a3389c4a79369ccf8ed1b71d55967879c90.zip.zip
Password: threatbook
-
28c6469d7ebbc79e7509d7fc3f4d8a3389c4a79369ccf8ed1b71d55967879c90.exe windows:4 windows x86
Password: threatbook
a6824cc4591dfc08d73759ecbb157fcc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetSystemDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualFreeEx
GetCurrentProcessId
CreateFileA
ReadFile
OpenFile
GetTempFileNameA
GetTempPathA
GetModuleFileNameA
DeleteFileA
Sleep
GetStartupInfoA
CloseHandle
GetCurrentProcess
GetLastError
CreateProcessA
user32
wsprintfA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
msvcrt
__getmainargs
sprintf
strcat
memset
fclose
fwrite
fopen
atoi
__p___argv
__p___argc
_exit
_XcptFilter
exit
_acmdln
_stricmp
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
Sections
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE