Static task
static1
Behavioral task
behavioral1
Sample
4794789de784ee0741a3ef029f7657ea237816900902705cd045df7839ed0f45.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4794789de784ee0741a3ef029f7657ea237816900902705cd045df7839ed0f45.exe
Resource
win10v2004-20231215-en
General
-
Target
4794789de784ee0741a3ef029f7657ea237816900902705cd045df7839ed0f45.exe.zip
-
Size
754KB
-
MD5
ac74d9b3a7f6f09f0910fa30b4fb7a39
-
SHA1
622bda551ccdac4f6acff2b0c0286e3a4a59614e
-
SHA256
e4b8924c387903e08270912d40e37d52d0df56be73e43ad2333cd8e359d5af0c
-
SHA512
8db46b8a72e977887916db6ef8ec8e502d6b8f1c8918d872600881a08de90cff1315dd2d05279d6b3c5fff735980a12507bf89ab8baf7760635ccc8001257b3f
-
SSDEEP
12288:jlJ91idsqJ9TOT0BQNfY5wycfa9ME8UiB14+Agk4dj9JkrnjE1JMkB4YxEVLWTVE:jlJ9wJ9TDBmuQa9Z8UMAgFqjSbxE8wUC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/4794789de784ee0741a3ef029f7657ea237816900902705cd045df7839ed0f45.exe
Files
-
4794789de784ee0741a3ef029f7657ea237816900902705cd045df7839ed0f45.exe.zip.zip
Password: infected
-
4794789de784ee0741a3ef029f7657ea237816900902705cd045df7839ed0f45.exe.exe windows:6 windows x86 arch:x86
e1beb25e9ba6465f9abcbd6c2d69dff7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
wsprintfW
qt5widgets
??1QMenu@@UAE@XZ
qt5gui
??1QPen@@QAE@XZ
qt5network
??1QHostInfo@@QAE@XZ
qt5core
??1QUrl@@QAE@XZ
rpcrt4
UuidCreate
wininet
DeleteUrlCacheEntryW
urlmon
URLDownloadToFileW
sensapi
IsNetworkAlive
ntdll
NtClose
ws2_32
WSAGetLastError
version
VerQueryValueW
winhttp
WinHttpOpen
advapi32
RegEnumKeyW
shell32
CommandLineToArgvW
Sections
.MPRESS1 Size: 717KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 218KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE