Static task
static1
Behavioral task
behavioral1
Sample
561a6d23194cfed9d58e68800460feb5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
561a6d23194cfed9d58e68800460feb5.exe
Resource
win10v2004-20231215-en
General
-
Target
561a6d23194cfed9d58e68800460feb5
-
Size
473KB
-
MD5
561a6d23194cfed9d58e68800460feb5
-
SHA1
87b60e4bd06f8b9e2adea1b63debc0bd1b293747
-
SHA256
96da63ecb992b139cbff0a324e7266927e9c84f6d38041523855c634b1f245c4
-
SHA512
7b090b96fc043b3a97f1d4a0fdeb0fec35638bce2e1e806a334af7475afa149094d9194169d0172ebcea02b625b1afcbf997138d49553561a1e5c76f953d3235
-
SSDEEP
12288:26awWFCYfynpwj9XQf6PmSOCt7zwZttn9g:4wKC2ww9gutnwZX6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 561a6d23194cfed9d58e68800460feb5
Files
-
561a6d23194cfed9d58e68800460feb5.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.q562yp Size: 814B - Virtual size: 555KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wf38$r Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.2vaxmu Size: - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gqkqw4 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wjblhf Size: - Virtual size: 20B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.175$40 Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fs$jux Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 436KB - Virtual size: 440KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 64B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
guocyok Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ximera Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE