Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Exploit.MSIL.Shellcode.exe
Resource
win7-20240221-en
General
-
Target
HEUR-Exploit.MSIL.Shellcode.gen-1000f3132573341fdf3f8f5534be81b6b257e8fa442c46c8d9c8e572f0007459
-
Size
2.8MB
-
MD5
99901e012e2ac7d532be1794ef0e42cb
-
SHA1
fa8b7aeeaea7ea264748583a661b0240b0d5cbba
-
SHA256
1000f3132573341fdf3f8f5534be81b6b257e8fa442c46c8d9c8e572f0007459
-
SHA512
66d25771b614e0f90133f01fba6c6104cd779f9bae04cd8799ca16e1f671375ff7dbe34867c80931e6f20e34d41650f897a0897c097c34566cc49dbddb03bb8c
-
SSDEEP
49152:64I2jzWPQYtgCZymsS+ruH0SnGrTRwuzh9GOJfRpzmACCDnVNkWIMOxbOOklIiH:s2vWPF+IJWdYcuSDnVNkWIlphklF
Malware Config
Signatures
-
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HEUR-Exploit.MSIL.Shellcode.gen-1000f3132573341fdf3f8f5534be81b6b257e8fa442c46c8d9c8e572f0007459
Files
-
HEUR-Exploit.MSIL.Shellcode.gen-1000f3132573341fdf3f8f5534be81b6b257e8fa442c46c8d9c8e572f0007459.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ