Static task
static1
Behavioral task
behavioral1
Sample
IncomingFax.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
IncomingFax.exe
Resource
win10v2004-20231023-en
General
-
Target
IncomingFax.7z
-
Size
98KB
-
MD5
c9c987cda1036d06fbe2d9b5f9fe35a3
-
SHA1
e0561e78ae2c6cd53be0f63a5e48534b94c7caea
-
SHA256
8e773ecccfe9db386b7e5f33c9be9fa2d4e5ec44745531b4617c13de3d90647f
-
SHA512
0d3232f6ce5711c4c32875f23d4a13430e65397257fdcf183fee48cdf44ecd3295c82d66331c33c1dfa8490fb9164db7fd44e48a86dbc15872593d57934175fd
-
SSDEEP
3072:XhfoH7CueWPTG75sUWujJ/GPXwSLTg5o47Ne7wE+77yXC:Fw7CuVG6Lc/IlqB7REA0C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/IncomingFax.exe
Files
-
IncomingFax.7z.7z
Password: infected
-
IncomingFax.exe.exe windows:5 windows x86 arch:x86
b66143d5da376cf91978e07e3fd870af
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetVersionExA
lstrlenA
GetProcessHeap
SetEvent
IsValidLocale
LeaveCriticalSection
CreateFileW
VirtualProtect
GetStdHandle
HeapSize
IsBadReadPtr
CreateFileW
GetPriorityClass
GetLocaleInfoA
SetFilePointer
CreateDirectoryA
HeapDestroy
CreateMutexW
SuspendThread
GetCurrentThreadId
GetFileAttributesW
GetModuleFileNameA
GlobalSize
ResumeThread
GetModuleHandleA
user32
LoadCursorA
DestroyMenu
GetWindowTextA
GetWindowLongA
DispatchMessageA
SetRect
DrawIcon
PeekMessageA
MessageBoxW
SetCursor
wsprintfA
GetWindowLongA
DestroyIcon
dpnet
DllGetClassObject
DllUnregisterServer
DllRegisterServer
DllCanUnloadNow
advapi32
IsValidAcl
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE