Static task
static1
Behavioral task
behavioral1
Sample
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1.exe
Resource
win10v2004-20240226-en
General
-
Target
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1
-
Size
353KB
-
MD5
ae4219dc1d5bd6f693cc75c135539ce4
-
SHA1
377b8aafc18502fa2e7430e5bca79a411aaac5ef
-
SHA256
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1
-
SHA512
2e2bfb3e7d38e0025b4e7849943e3bedad9c5daa0713b66dfaeda615544d5e3963a44bc1221a7a95d09201161a49cf5dba285f4114bc4193154b5dfac03926ed
-
SSDEEP
6144:E9Y/0Vkb4LFo2yXafnftfjmBaIEtUYvlkUEL8BhAe2qQQuYP4Lb+nxpddhRI:Z/wzFo2LnfzIE6ulZxh+3YPG+nxpddhK
Malware Config
Signatures
-
Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_ConfuserEx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1
Files
-
ff3a76774d1e5729572bb2194513432c1c64d05dc66910539258610b047110d1.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
ZkD Size: 299KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ