PERSPICIATISM.iso
- SHA256 c2071407cf960fa166ac47d86f4a92b64873cd8c37a4ea416e80488c5f327c8f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Open_Document.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
data/document.rtf
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
data/document.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
edputil.dll
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
edputil.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target PERSPICIATISM.iso
- Size 166KB
- Sample240306-xfr4lsfe26
- SHA256 c2071407cf960fa166ac47d86f4a92b64873cd8c37a4ea416e80488c5f327c8f
- MD5 75ea2aa8c2a3503ed39fd807de9fe0a3
- SHA1 09554bdd6197cb848ce2bb69cd353c1d34bafc2c
- SHA512 c4ffc40425e4d5903a62cb6beb76a239393b4525437f01a2e67e7e1992c206bfb3ec4332b667146515f9a6ed3f6c6e442cc13d68c4fac9049516eca246078d8a
- SSDEEP 1536:ebnS9bCgj6dJEkgOzOk3+oLGzFjO8n2dtkosu31M:9EDzPJL2mX
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Open_Document.exe unpack002/edputil.dll
File Explorer
-
PERSPICIATISM.iso.iso 166KB
-
out.iso.iso 166KB
-
Open_Document.exe.exe 11KB
-
data/document.rtf.rtf 3KB
-
edputil.dll.dll 95KB
out.iso
- SHA256 c2071407cf960fa166ac47d86f4a92b64873cd8c37a4ea416e80488c5f327c8f
- MD5 75ea2aa8c2a3503ed39fd807de9fe0a3
- SHA1 09554bdd6197cb848ce2bb69cd353c1d34bafc2c
- SHA512 c4ffc40425e4d5903a62cb6beb76a239393b4525437f01a2e67e7e1992c206bfb3ec4332b667146515f9a6ed3f6c6e442cc13d68c4fac9049516eca246078d8a
- SSDEEP 1536:ebnS9bCgj6dJEkgOzOk3+oLGzFjO8n2dtkosu31M:9EDzPJL2mX
- MD5 SHA1 SHA512 SSDEEP
Open_Document.exe
- IMPHASH 90a23f469ba0443719430cba4569b220
- SHA256 a70d52eda892edc073932b462cc367cdbfbace3f4196857d8d4fa869a13de792
- MD5 b947cca7f485f6c1156f4d02e8c9874f
- SHA1 9f184e48f17f104c6a476687e8e760a65a0326b5
- SHA512 28c6ff32bc94aad8b201e469f854dde32cad9eb2e7a80ed858ac2ff99648312cecca06918bce96e8d905d52d5ebee076bd08d957f7933602c0c79d93ead20ee3
- SSDEEP 192:ZV89t7hglDCS8O3GbXdYFWihWxu/sWGOW:ZVM7hceSP3IXioxu/sWGOW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
write.pdb
shell32
ShellExecuteW
kernel32
TerminateProcess
GetCurrentProcess
GetStartupInfoW
HeapSetInformation
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
Sleep
msvcrt
_commode
?terminate@@YAXXZ
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
204B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=27412,
count=2, id=259, version=27412,
count=17, id=260, version=27412,
count=35, id=1, productName=Unmarked objects,
count=7, id=257, version=27412,
count=2, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
data/document.rtf
- SHA256 66bcb4ff2b542638fad440578934d815d2aa17242e623055d775a5017e9094a4
- MD5 b165a780f5d3061dceb7baee37c44a50
- SHA1 333492656052c9716efdeee553c5a17c6cbc91d2
- SHA512 763acc988dd3a43a2e3b106b264a53b020404c7776b0a33f3ef0c6b5a26b7945597a7b530e6e1b8ad185a4dd956db8300dd0602971885d7e635d56384a569c95
- MD5 SHA1 SHA512
edputil.dll
- IMPHASH 06047b89c9be4c3913c55c1c549f5e99
- SHA256 905a3a144f94a38ac6059759879caec19cff446b98c24bb2035b3293330e03b2
- MD5 4b46474e51d8687190e4e539b6691f9a
- SHA1 7f32b12ba975205e29b113a000dc87758e5deaf2
- SHA512 85eafcdbdffc2ca88f89a7078664dfbd00356f1dc7d1de1848ec5c7e162748132834b8d59f0df658eb31a8640494ef8c309b005c628d871c5f52b84bb5d1f7e0
- SSDEEP 1536:ebCgj6dJEkgOzOk3+oLGzFjO8n2dtkosu31Mv:RDzPJL2mXQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4944
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WinExec
msvcrt
__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
realloc
strlen
strncmp
vfprintf
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
1024B
Virtual Size
720B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/31
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/45
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/57
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
1024B
Virtual Size
813B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/81
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/92
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ