Static task
static1
Behavioral task
behavioral1
Sample
EThl143dx9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
EThl143dx9.exe
Resource
win10v2004-20231215-en
General
-
Target
4809787776dc743c65522f5fb839bd4a
-
Size
147KB
-
MD5
4809787776dc743c65522f5fb839bd4a
-
SHA1
f4d8a7ae38ef8de22107fa69423cb0122939ba9a
-
SHA256
3ee92d69bfc7a968cad41e4604966fc5767d00e7a6307bcaf284b48e62f658ce
-
SHA512
8a7c96f7993f5913e2702269cc08d599af54d4f240d2a750fd7e646cf22a9a2d2d0a13ea8ce1163cd0b9670dc97a4ab06680eda0c7ef0739610361a9abb87300
-
SSDEEP
3072:dTVvY4PyuXk3Ml7BKdXZWzXr4Pz9z4Rw8fF0K1sgfdLXxiGL/A3OsvWf507:dltX2MwZekz9zmwQdlXAGc3OsvWfm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/EThl143dx9.exe
Files
-
4809787776dc743c65522f5fb839bd4a.zip
-
EThl143dx9.exe.exe windows:4 windows x86 arch:x86
9c8decf3582072f6edfc385a689f44f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
DeleteFileA
ExitProcess
FreeLibrary
GetCommandLineA
GetFileTime
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryA
lstrcatA
lstrcmpiA
RemoveDirectoryA
SetFileTime
VirtualAlloc
VirtualFree
WriteFile
Sections
.text Size: 1024B - Virtual size: 918B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 652B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 129KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE