Static task
static1
Behavioral task
behavioral1
Sample
msFormat/MS-Format1.0.307.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
msFormat/MS-Format1.0.307.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
msFormat/MyDiskTest.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
msFormat/MyDiskTest.exe
Resource
win10v2004-20231215-en
General
-
Target
7e97a0cba3dd5aa55209921e06ec1928
-
Size
4.8MB
-
MD5
7e97a0cba3dd5aa55209921e06ec1928
-
SHA1
c1ac97dbd11833aad035f766a673b8ad3d77e34e
-
SHA256
d397c8314ae733e165f8e4bf9e87132b6aa2c534564a618062e4ba57f898f21a
-
SHA512
2d69f71a3fc34071c8023a668a3c7f9628bb0fad5f5652a4d780bb06fd8e36b16a96a593f9ad3af2c714a0c29aa800bf64787365cb5fc892860239e7843fc61d
-
SSDEEP
98304:Io7ARtuVdYU19AmfESnj8kc6yu9t2/9S0lwEruYgN27BPcEzFWa1tIoxK0xXLn7Y:IouYzRL+Z6yCanWEruZ27BlFWa1zxK0+
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/msFormat/MS-Format1.0.307.exe unpack001/msFormat/MyDiskTest.exe
Files
-
7e97a0cba3dd5aa55209921e06ec1928.rar
-
msFormat/MS-Format1.0.307.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
Size: 15KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
FSLOVE Size: 720KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
msFormat/MyDiskTest.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
WRC0 Size: - Virtual size: 204KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
WRC1 Size: 47KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
msFormat/注册表.rar.rar
-
a.reg