Static task
static1
Behavioral task
behavioral1
Sample
SharpImpersonation.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
SharpImpersonation.exe
Resource
win10v2004-20231023-en
General
-
Target
SharpImpersonation.exe
-
Size
123KB
-
MD5
b368aa6227357a5b0c7776cea35c05cb
-
SHA1
85b2db251e0aebfd106224373d5dd10d1fe4886b
-
SHA256
606b448ba2a84f60aa13b4c32c67f7cf29143da8dc11c5c136c3017e898e4ede
-
SHA512
fdeec604487e45b89a3b982cc0047060fbe36444c0cf73398af4f89d21e3dfa40ba20f3d00449368fcb7ec0d4fb0cdcc11cf57b5964c797e3df04f74f7b352d8
-
SSDEEP
1536:+WUs4NnM+jDspU155iB0kAmkhESikbx5TuPMZtvIZ80PEtLyor3aphqVC/lZjGNy:+3KpUTAikAmkikbx5SPJZ80POOuoZN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SharpImpersonation.exe
Files
-
SharpImpersonation.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ