Static task
static1
Behavioral task
behavioral1
Sample
616066741b94092323088fe5678b78f1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
616066741b94092323088fe5678b78f1.exe
Resource
win10v2004-20231215-en
General
-
Target
616066741b94092323088fe5678b78f1
-
Size
239KB
-
MD5
616066741b94092323088fe5678b78f1
-
SHA1
675515fca47ab53d191f9c51b669f8ad3cbd699c
-
SHA256
86bcd12566748918ddf5fe4ce28aed363676e5cccc38cc80ca98abd2d0aa2a8f
-
SHA512
c7220cba54a831ad97fb241e1530812f8aed20feb573baa12d7e389e5f7649622adb1b42ced9a7e224a7a1238bcf27f7444ac86b69ec0b655c01c88da9773932
-
SSDEEP
6144:pSApbtbSW7uz3OLyOhWGgoJUt7Gy+Rlmk/0THjj/UTYu:pdvbSWi+LXh7guNy+RQkMTfdu
Malware Config
Signatures
-
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
resource yara_rule sample beds_protector -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 616066741b94092323088fe5678b78f1
Files
-
616066741b94092323088fe5678b78f1.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 198KB - Virtual size: 197KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ