Static task
static1
Behavioral task
behavioral1
Sample
054738f3143c5fc0c2bf0bc608fad21705c735e098c98aad2979750cf8095dde.exe
Resource
win7-20240221-en
General
-
Target
054738f3143c5fc0c2bf0bc608fad21705c735e098c98aad2979750cf8095dde
-
Size
100KB
-
MD5
638a8a431bbde2e494df5bb3b9ac1390
-
SHA1
e9db10966f214ae66619e52c43c5c5700e0ae1c3
-
SHA256
054738f3143c5fc0c2bf0bc608fad21705c735e098c98aad2979750cf8095dde
-
SHA512
0225dbce4a99765a8f2c2feac260dfa10be0d9eed297b076342f2e15c4889724f637ec46381cf06a853d763e3b780e90e19a504bbe55f2d875d4893cda91bf00
-
SSDEEP
3072:4waUYYN9B0V3od+XIttWVQEnnnmZaGBvhOKjvzOl:ja1sCoxttWV5HGlhxvzOl
Malware Config
Signatures
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_SimplePolyEngine -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 054738f3143c5fc0c2bf0bc608fad21705c735e098c98aad2979750cf8095dde
Files
-
054738f3143c5fc0c2bf0bc608fad21705c735e098c98aad2979750cf8095dde.exe windows:4 windows x86 arch:x86
14610dd0ebbc796a9a3a2ba2cdd24e79
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
user32
MessageBoxW
Sections
.text Size: 72KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE