Static task
static1
Behavioral task
behavioral1
Sample
Ri9RSdOwP2DvMFi.exe
Resource
win7-20231215-en
General
-
Target
9cf8652774703750e214e49012b8aeb2
-
Size
867KB
-
MD5
9cf8652774703750e214e49012b8aeb2
-
SHA1
f75dee81dda3cb5e13e7bc2d106c90fd33c78b75
-
SHA256
11f56953a80011adac61595a11f0d716a9a24e0fb7e20b95dbd55d0c4b3c0781
-
SHA512
c2cd8eeb7d7a8e1eaf19696596cd2e3ae6e10cb4f748800d41815455d7c7f6a105444ca87312d40c6347d21bdffd0faa631abc0b2fd868da2f60fc5ee0f6e19d
-
SSDEEP
12288:XaK1E9C67cnDmBF3cSKjJ9vXb+hHaSdn46U/v/UP/cuFG1yIPggTqI69ktY66M91:X31E9C64nYqvLJS+6fP7IogTC9kB91
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Ri9RSdOwP2DvMFi.exe
Files
-
9cf8652774703750e214e49012b8aeb2.eml
-
https://www.dhl.com
-
http://www.dhl.com
-
-
custom duty invoice & its clearance documents.rar.rar
-
Ri9RSdOwP2DvMFi.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 650KB - Virtual size: 649KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 131KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
email-html-2.txt.html
-
email-plain-1.txt
-
image.png.png