Static task
static1
Behavioral task
behavioral1
Sample
b7cdb0a9b1211fbf28b08993d7a74fbf33001b01bafd77b4262005f2cf2879ab.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b7cdb0a9b1211fbf28b08993d7a74fbf33001b01bafd77b4262005f2cf2879ab.exe
Resource
win10v2004-20231222-en
General
-
Target
b7cdb0a9b1211fbf28b08993d7a74fbf33001b01bafd77b4262005f2cf2879ab.exe.zip
-
Size
2.9MB
-
MD5
d6442f3cf99c49c0cff8ce913030987a
-
SHA1
ae10d83a92f30c9a111d3618e8789a00f22af7e3
-
SHA256
950c0c79147cdbb263a3f3cc900413a7288d7121cb8f26593e3b17de954b94fa
-
SHA512
58bf4ab9bb86d62c1e07c8f67391a87507ec2c14bfd2ac2762eb1a46cbf324b764ea5844c65aae13197e85def114f5fe4c0ca19d99c8882faa868aa0c6d4f0b5
-
SSDEEP
49152:3oaDRfnev0R64fVD/aKqwH4ufAZP/X7Z+ug5DE0Z5xv7fEDlcejCIoWfK:JFnevV41iLwHIZX7ZTg1E07x8jCIoWfK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b7cdb0a9b1211fbf28b08993d7a74fbf33001b01bafd77b4262005f2cf2879ab.exe
Files
-
b7cdb0a9b1211fbf28b08993d7a74fbf33001b01bafd77b4262005f2cf2879ab.exe.zip.zip
Password: infected
-
b7cdb0a9b1211fbf28b08993d7a74fbf33001b01bafd77b4262005f2cf2879ab.exe.exe windows:5 windows x86 arch:x86
b644ebb2ccbd9e5e3e442a399d02d1c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
powerdatarecoverycore
??1KMemoryPool@@UAE@XZ
ikernel
klog_log
qt5core
?qrand@@YAHXZ
qt5gui
??1QPen@@QAE@XZ
qt5widgets
??1QMenu@@UAE@XZ
qt5network
??1QSslError@@QAE@XZ
user32
GetDC
gdi32
DeleteDC
advapi32
RegCloseKey
shell32
ord155
ole32
OleRun
oleaut32
SafeArrayCreateVector
msvcr120
rand
msvcp120
?_BADOFF@std@@3_JB
propsys
PSGetPropertyKeyFromName
mpr
WNetCloseEnum
libeay32
ord340
libcurl
curl_easy_init
Sections
.MPRESS1 Size: 2.8MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 182KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE