Static task
static1
Behavioral task
behavioral1
Sample
bo2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bo2.exe
Resource
win10v2004-20231215-en
General
-
Target
bo2.exe
-
Size
1.2MB
-
MD5
bce448a8b773bebf4dfd24d6e679e859
-
SHA1
c9255e3e03d8d79bd41857924f8c4b492c5de039
-
SHA256
7c9580843bffd62ef52b6ccf456f25f35dbb4d94f8bb9022d3b5ab1626745b07
-
SHA512
a24ca5d4b717eb726c9781efa876607c0759e236ee4667dd2335219d8aee6539d4dbbe580ec0e6fdca55c1a0770e6f8302ae35fcef647e328ecb592a3d47dee6
-
SSDEEP
24576:OArde7YDuD5jggnGAp3/hu4MOnRK4yYJV/xsjShDF+c7028q0wY1GLzJ:O+AY6jguG2poUt2g0RgL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bo2.exe
Files
-
bo2.exe.exe windows:4 windows x64 arch:x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ