Static task
static1
Behavioral task
behavioral1
Sample
96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe
Resource
win7-20231215-en
General
-
Target
96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe.zip
-
Size
7.2MB
-
MD5
00d22f8dcc05c9577f57880dc11ef71f
-
SHA1
69cad734595e320959f1c692e3b80a704d873ef3
-
SHA256
77e1490709c7c6f6358d6b02ffd919625f4f5cb185e224dc2b792a407667fdfd
-
SHA512
822915d81cd6986221bf6d4090b91a7910c68e35ea962445cf86dc8df14669a4b1c06acbea4032fa01be0a7e6109145f587bf8d4e3a59520f66317dc25523d77
-
SSDEEP
196608:ITzPGL8P81KOPB2US4KC1MGgz6b1TDzUpqhBfn7Nqh1I+:ITzPGIP8152/tOs2JnzUsHnRc1I+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe
Files
-
96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe.zip.zip
Password: infected
-
96415e81bc58eea6ed54be6fc8451df76b7285497f3b199bfb67d327e0357a33.exe.exe windows:6 windows x64 arch:x64
b2fe9aeba9d6710be23fc4a93f730186
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
Imports
kernel32
GetModuleHandleA
GetProcAddress
advapi32
FreeSid
cfgmgr32
CM_Get_Device_IDA
comdlg32
GetOpenFileNameA
crypt32
CertOpenStore
gdi32
LPtoDP
imm32
ImmGetContext
msimg32
AlphaBlend
odbc32
SQLFetch
oleacc
LresultFromObject
oleaut32
VariantCopy
propsys
PropVariantGetInt32Elem
rpcrt4
UuidToStringA
shell32
DragFinish
shlwapi
PathIsUNCA
secur32
LsaFreeReturnBuffer
user32
GetDC
uxtheme
IsAppThemed
version
VerQueryValueA
winmm
mixerOpen
winspool.drv
GetJobA
wintrust
WinVerifyTrust
ws2_32
send
gdiplus
GdipFree
imagehlp
ImageLoad
ole32
DoDragDrop
Sections
.MPRESS1 Size: 6.9MB - Virtual size: 26.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 539KB - Virtual size: 538KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE