Static task
static1
Behavioral task
behavioral1
Sample
both.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
both.exe
Resource
win10v2004-20231215-en
General
-
Target
a49f530abfac2db575ac825ebf1763ce
-
Size
5KB
-
MD5
a49f530abfac2db575ac825ebf1763ce
-
SHA1
dce60768e116190215ecfb16d3c2888d80b6e9a5
-
SHA256
7c08d5f31a27ae80b8ba3987c848d46af4a630156d636c0193e9f5f9d3703e5b
-
SHA512
7ddf614dd8b2f69764cb8539c77b9e51568cb000553ddbf15c8e0416da6267918dbf766d9257c007fbc73ed2f9237720f2e272e36a9a726cc3141f1bdc8cf5f6
-
SSDEEP
96:B7xEeKR+/ENLEjAO5jIrXhVPnTeR7nWaYNdX4DOEzjyYJB5PPVH9voZ/h:BFFPENwj7tAhV/TeR7nDYf4KEfyYJBNg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/both.exe
Files
-
a49f530abfac2db575ac825ebf1763ce.eml
-
FX201924784.cab.rar
-
both.exe.exe windows:6 windows x86 arch:x86
c954d787ed83e16e93cd194e921d4d5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
mpr
WNetConnectionDialog
WNetGetNetworkInformationA
WNetAddConnection3A
WNetCancelConnection2W
WNetGetResourceInformationA
WNetAddConnection2W
msvfw32
DrawDibRealize
ICImageDecompress
DrawDibEnd
avifil32
AVIStreamSampleToTime
AVIStreamFindSample
AVIStreamRelease
EditStreamClone
shell32
SHGetDesktopFolder
ShellExecuteW
ExtractIconEx
msacm32
acmDriverAddA
acmFormatSuggest
acmFormatEnumA
acmDriverDetailsA
acmFormatDetailsW
XRegThunkEntry
acmFormatTagEnumA
acmStreamMessage
acmFormatDetailsA
mscms
TranslateBitmapBits
GetCMMInfo
GetColorProfileHeader
msi
ord163
ord79
ord110
ord75
ord27
ord164
mapi32
ord131
ord62
ord18
ord152
setupapi
SetupDiRemoveDeviceInterface
SetupQueueDeleteSectionW
SetupDiGetHwProfileFriendlyNameExA
user32
MessageBoxW
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
email-plain-1.txt