Static task
static1
Behavioral task
behavioral1
Sample
158900b745c256a090351228530873b4d3835d79a148927de1415db6965d23dd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
158900b745c256a090351228530873b4d3835d79a148927de1415db6965d23dd.exe
Resource
win10v2004-20231222-en
General
-
Target
9300c19a497c2997f9c1607cfa9333f3.bin
-
Size
614KB
-
MD5
647aa6cb8122d2ef6e9099fd304db0cb
-
SHA1
8bdb5dd688cf0f4fae419e95e5630149c8bd3ee3
-
SHA256
709120db1505d0c07eb2160cba2c6f666e4971f3abea7216698b4d167f8dd689
-
SHA512
4a3d6597dc399750d54a8ec7603f051466421ebb09fbcc32fc5ae02405bd94a23dec7e7a0176709352797923795b1a77c48028647c8a4c06b6ca3720c2b03200
-
SSDEEP
12288:+YehdvE9WQ4ARDgna3bEuwEjNpGFUIdbfC/JNKJcGwEJFMHHvRH7hc0eHlbxV5:+tvvEpyUbCEjqUwjMJ8JczE7MnZHK7b9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/158900b745c256a090351228530873b4d3835d79a148927de1415db6965d23dd.exe
Files
-
9300c19a497c2997f9c1607cfa9333f3.bin.zip
Password: infected
-
158900b745c256a090351228530873b4d3835d79a148927de1415db6965d23dd.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 631KB - Virtual size: 630KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ