Static task
static1
Behavioral task
behavioral1
Sample
Patch.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Patch.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
downloader.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
downloader.exe
Resource
win10v2004-20231215-en
General
-
Target
15da4800a7e21bcf9c545b24b4fabd53
-
Size
27KB
-
MD5
15da4800a7e21bcf9c545b24b4fabd53
-
SHA1
c133d96c30fc6252b8439f3c1f9fb373b8a1052b
-
SHA256
5b2a643c00d893714bc2af4fc94b2c94ef3d44dc8bb356673e34dc51915b0997
-
SHA512
2db1bb0cbb9d29f11c3bc46ff4e3bdfca6a64dadfc7eb4c88e0e6a09a82b71dca7acf93fbc62b00594c697271285511b1f0a72c76b7f519a8614df721382f6c1
-
SSDEEP
768:mk/uC5EAlk96MstlLrQcaKslq/BpbVSmiTEDWgDDaGlN+iRPd8jO:mkA596MKz1slySma2WGlNdWO
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Patch.exe unpack001/downloader.exe
Files
-
15da4800a7e21bcf9c545b24b4fabd53.cab
-
Patch.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 138B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
downloader.exe.exe windows:4 windows x86 arch:x86
4e6e0cfaea4acc1bac225692555e1e58
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
rand
srand
strncpy
memset
malloc
fclose
fwrite
fopen
strcmp
_exit
_XcptFilter
exit
sprintf
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strlen
__p___initenv
_snprintf
kernel32
Sleep
GetTickCount
shlwapi
StrToIntExA
Sections
.text Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 956B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE