Static task
static1
Behavioral task
behavioral1
Sample
42a6da4b6bb42792c3fc1b77e1b98d01d58f275cc7f752dcd46c814abc789b6c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
42a6da4b6bb42792c3fc1b77e1b98d01d58f275cc7f752dcd46c814abc789b6c.exe
Resource
win10v2004-20231215-en
General
-
Target
42a6da4b6bb42792c3fc1b77e1b98d01d58f275cc7f752dcd46c814abc789b6c.exe.zip
-
Size
3.0MB
-
MD5
241331ea5684a2c4fe60580d84da5a8d
-
SHA1
c9042759aef796834dd683b780c17bb54565daf5
-
SHA256
6d68983484290acc9917ab6031f49a877d18e9c06024f567fe7bab58977c7d15
-
SHA512
29435fab6bfbc3cf1884b9e141aad960f385a9a38e685839ae3aa9f8a724bb11c3ae399b88e54aeece7ef0a7a6ca2270a139e446b6926f68e5cf7a65a052fa8e
-
SSDEEP
98304:NgIqZLRNu2NgkwyRS+vbjRDqAlPLVAzYLyAZ:NnmLREGS4s2hAtAZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/42a6da4b6bb42792c3fc1b77e1b98d01d58f275cc7f752dcd46c814abc789b6c.exe
Files
-
42a6da4b6bb42792c3fc1b77e1b98d01d58f275cc7f752dcd46c814abc789b6c.exe.zip.zip
Password: infected
-
42a6da4b6bb42792c3fc1b77e1b98d01d58f275cc7f752dcd46c814abc789b6c.exe.exe windows:5 windows x64 arch:x64
cfd25bb8b565beae8243cdfa604fadc6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
powerdatarecoverycore
??1KMemoryPool@@UEAA@XZ
ikernel
klog_log
qt5core
?qrand@@YAHXZ
qt5gui
??1QPen@@QEAA@XZ
qt5widgets
??1QMenu@@UEAA@XZ
qt5network
??1QSslError@@QEAA@XZ
user32
GetDC
gdi32
DeleteDC
advapi32
RegCloseKey
shell32
ord155
ole32
OleRun
oleaut32
VariantClear
msvcr120
rand
msvcp120
?_BADOFF@std@@3_JB
propsys
PSGetPropertyKeyFromName
mpr
WNetCloseEnum
libeay32
ord340
libcurl
curl_easy_init
Sections
.MPRESS1 Size: 2.9MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE