Static task
static1
Behavioral task
behavioral1
Sample
42d80a7e17e15040f0e003e66071c9ed.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
42d80a7e17e15040f0e003e66071c9ed.exe
Resource
win10v2004-20231215-en
General
-
Target
42d80a7e17e15040f0e003e66071c9ed
-
Size
351KB
-
MD5
42d80a7e17e15040f0e003e66071c9ed
-
SHA1
1484283aefddbf002fbaa58db74f0623e8ece0eb
-
SHA256
ab4cc0b5d8af11f192917782d8bc88227f085cd8251932447dea2bda25ecc7e0
-
SHA512
d1d6f6d13f9b0cdb0da3332d58f4c4d2744b1573f45c6f86e09ae9d9e9f66cab3c8ae09f7e4d6f8ddd96561eca0a61f7b44d89bd8e323155c6eb801bccebefa0
-
SSDEEP
6144:nvKHQJiIcV4AtvT4x7FXA/1tCHMJZNLGiaxyvlzRZ4dJvbKC9DR6V:nvKHQgIcV7M5A/GHMJeiawlb4dJbKody
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42d80a7e17e15040f0e003e66071c9ed
Files
-
42d80a7e17e15040f0e003e66071c9ed.exe .ps1 windows:4 windows x86 arch:x86 polyglot
94c7366d739e7bf962bb011f2c5fab76
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
GlobalAlloc
ExitProcess
Sections
pcs1 Size: 323KB - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pcs2 Size: - Virtual size: 7KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pcs3 Size: 1KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pcs4 Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pcs5 Size: 512B - Virtual size: 35B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pcs6 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pcs7 Size: 15KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pcs8 Size: 5KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ