SU-30 Aircraft Procurement.iso
- SHA256 4fa0e396cda9578143ad90ff03702a3b9c796c657f3bdaaf851ea79cb46b86d7
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
.temp/.tmp.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
.temp/.tmp.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
.temp/sample.pdf
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
.temp/sample.pdf
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
Air HQ PR Policy.lnk
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
Air HQ PR Policy.lnk
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target SU-30 Aircraft Procurement.iso
- Size 24.8MB
- Sample240111-sa124sagc7
- SHA256 4fa0e396cda9578143ad90ff03702a3b9c796c657f3bdaaf851ea79cb46b86d7
- MD5 7317ff828f94cc104e93c259025eb465
- SHA1 46bee284a2f3be9b429e014d01b5a30d0821aee9
- SHA512 dc9f6e0d6d642edb427d5b003ee0daf4ad28c149f3fe2aa2edeb52c0bb6b9f33de17c117d97fcabc4a4479c626bdf4671058d07290289f6285465213f1bc04cc
- SSDEEP 196608:4iyAee0EFuGYxn26HSJyyx9uRhS4nw8D:YAL0EFixnZHSJlS/w8D
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/.temp/.tmp.exe
File Explorer
-
SU-30 Aircraft Procurement.iso.iso 24.8MB
-
out.iso.iso 24.8MB
-
.temp/.tmp.exe.exe 24.6MB
-
.temp/sample.pdf.pdf 140KB
-
Air HQ PR Policy.lnk.lnk 1KB
out.iso
- SHA256 4fa0e396cda9578143ad90ff03702a3b9c796c657f3bdaaf851ea79cb46b86d7
- MD5 7317ff828f94cc104e93c259025eb465
- SHA1 46bee284a2f3be9b429e014d01b5a30d0821aee9
- SHA512 dc9f6e0d6d642edb427d5b003ee0daf4ad28c149f3fe2aa2edeb52c0bb6b9f33de17c117d97fcabc4a4479c626bdf4671058d07290289f6285465213f1bc04cc
- SSDEEP 196608:4iyAee0EFuGYxn26HSJyyx9uRhS4nw8D:YAL0EFixnZHSJlS/w8D
- MD5 SHA1 SHA512 SSDEEP
.temp/.tmp.exe
- IMPHASH 4681a7f123ce1530ebc7fe104fa3f584
- SHA256 dab645ecb8b2e7722b140ffe1fd59373a899f01bc5d69570d60b8b26781c64fb
- MD5 3309ec4eb3d75c9c478fdd50c678e4e8
- SHA1 cea72265caf9b4746d3d925f795e62df24ff7d61
- SHA512 166ceb5dc3a27b1aac4e30459fd6320ee16a5232b6f46c4e1560f89d975f1fafc04a80a94fa7466f8d58accc8ec38fb399e61ec291dae0b905f6a042ff083563
- SSDEEP 196608:GiyAee0EFuGYxn26HSJyyx9uRhS4nw8DJ:mAL0EFixnZHSJlS/w8DJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
AddVectoredExceptionHandler
AreFileApisANSI
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateThread
CreateWaitableTimerA
CreateWaitableTimerExW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DuplicateHandle
EnterCriticalSection
ExitProcess
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetEnvironmentStringsW
GetErrorMode
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetTickCount
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
PostQueuedCompletionStatus
QueryPerformanceCounter
RaiseFailFastException
ReadFile
ResumeThread
SetConsoleCtrlHandler
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
SystemTimeToFileTime
TlsAlloc
TlsGetValue
TryEnterCriticalSection
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
memcmp
memcpy
memmove
strrchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_beginthread
_beginthreadex
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_endthreadex
_errno
_exit
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
fwrite
api-ms-win-crt-string-l1-1-0
memset
strcmp
strcspn
strlen
strncmp
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_localtime64
_tzset
api-ms-win-crt-utility-l1-1-0
qsort
_cgo_dummy_export
authorizerTrampoline
callbackTrampoline
commitHookTrampoline
compareTrampoline
doneTrampoline
preUpdateHookTrampoline
rollbackHookTrampoline
stepTrampoline
updateHookTrampoline
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
319KB
Virtual Size
318KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
376KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
345B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
79KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
609KB
Virtual Size
609KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
4.3MB
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/106
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/125
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/141
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/157
Size
190KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
.temp/sample.pdf
- SHA256 999635f52114ca98fbfd5bf1cca9d6dc8030950baaa1a154619bd830238650f5
- MD5 d32a89ee1181bfd990ac5ded081ec650
- SHA1 848485a5c0f30bdffd0c8e2ca336f23836da171a
- SHA512 6802062fdcdaa41b17ad5a1cc8bebb1fcbb9a874933578d42d06d7a8290902abf8a1aaeaa4b04b35c1b9d57639a5c262198a9c717f0dfbec7bf028d1a1c3bcdc
- SSDEEP 3072:DpJ5377sW8DJ93rcAtOhg4Oce8n1xdobMvV7OcZox6oVz:DZcWi93wAt6DpVLKz
- MD5 SHA1 SHA512 SSDEEP
Air HQ PR Policy.lnk
- SHA256 a811a2dea86dbf6ee9a288624de029be24158fa88f5a6c10acf5bf01ae159e36
- MD5 b10a77609b6420cc5247897d741ab41e
- SHA1 f956660e3970f293ef44437a0234c4f5588c11f3
- SHA512 0419a9befbbdbb4f7b67bfa701f0d748401b397be3516ab85fb264d5bad8b71f3d953a50000e558d6b7d1c33d47aa8c9b09c911d175ab984f70ccc6c16989957
- MD5 SHA1 SHA512