Static task
static1
Behavioral task
behavioral1
Sample
Wyyqwqt.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Wyyqwqt.exe
Resource
win10v2004-20231215-en
General
-
Target
PURCHASE ORDER No POCON18025(1).rar
-
Size
901KB
-
MD5
4dfc52ecf60932849478b8273f783a5b
-
SHA1
11e794e85dfe421e5290282c72f843fefa23d5a2
-
SHA256
66224281d9b0d8b1d29d9096cdd7badcdff59928c9258d0fa7dd60b96d7d17ac
-
SHA512
77f6ce2b7b8ef0bcaea419b5121d7dd19198e4fcc5964e4c676cc1ee1194545c33fc3bf0f48527dd974a53add10ef13c0562acae58b07e9896bfab80f83bb2b2
-
SSDEEP
24576:qx6AJJuDhmz01JEslC+3tvvtN1kwPv6tzfozC4w:+Ocz01JEsgWvv1k9yC4w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Wyyqwqt.exe
Files
-
PURCHASE ORDER No POCON18025(1).rar.rar
-
PURCHASE ORDER No POCON18025.img.iso
-
Wyyqwqt.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 917KB - Virtual size: 916KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ