Static task
static1
Behavioral task
behavioral1
Sample
Pecxxgetfb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Pecxxgetfb.exe
Resource
win10v2004-20231215-en
General
-
Target
a5f3bb528d20cb7a922fb32a73c06e2c.bin
-
Size
1.5MB
-
MD5
9f97adec3a281e2e6cd041d28acc82b8
-
SHA1
ad7bcfc5f1e43bf3212af613cbed519dc74e37fa
-
SHA256
b9cde1ad3d2d37b87b9c6de9b33a71efc399cfb39ee3cf57c4eecba5189a941b
-
SHA512
37dde7b3a21742e214baad9bfbe7442f76a46d1eb8056202fd444569f3b587a2347e287eb0493ba573787a33208aa859c67e094209f71d52239f69a6df7dc554
-
SSDEEP
24576:aP1zlWknw3+TYCclMc0kL5TW60djwYScX2ULrGGrX39C2D902vDgqSAAAKfE:8tUR3+TYC/c0kM688cFGeX39CG91vSAx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Pecxxgetfb.exe
Files
-
a5f3bb528d20cb7a922fb32a73c06e2c.bin.zip
Password: infected
-
be7ec5e6830caf67bde61d7f3ebb99e9003a9b13dd6c64115f5333d6f273885c.img.iso
Password: infected
-
Pecxxgetfb.exe.exe windows:4 windows x64 arch:x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ