Static task
static1
Behavioral task
behavioral1
Sample
055a6652e338c8e171ade5520bd4d0d8b66659d7db1e1ecfeb3a08149ff78b54.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
055a6652e338c8e171ade5520bd4d0d8b66659d7db1e1ecfeb3a08149ff78b54.exe
Resource
win10v2004-20240226-en
General
-
Target
055a6652e338c8e171ade5520bd4d0d8b66659d7db1e1ecfeb3a08149ff78b54
-
Size
34KB
-
MD5
73f56fe5a72e36480129cc85e8abec47
-
SHA1
9297cc3c80f6069d41ec581d8f405d09e29196a2
-
SHA256
055a6652e338c8e171ade5520bd4d0d8b66659d7db1e1ecfeb3a08149ff78b54
-
SHA512
dfa32263da2a58e75f49c948b2a02f49c373e8417012179d3f439570cf79a767125982bcc51e26830d01a79bc6122c9ff42cdf91225dbd1ae1411b9c68a656eb
-
SSDEEP
384:ILPp8GO0DQPMNKqvmUxKJ7J9N8B8iJ69BnqmaUsbqtZ9LT9npzl+1Pjn5Hf1kzny:2RO0UXqvm6cNwJ69psmpManu0/e
Malware Config
Signatures
-
Detects executables calling ClearMyTracksByProcess 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 055a6652e338c8e171ade5520bd4d0d8b66659d7db1e1ecfeb3a08149ff78b54
Files
-
055a6652e338c8e171ade5520bd4d0d8b66659d7db1e1ecfeb3a08149ff78b54.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 668B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ