TMethodImplementationIntercept
Static task
static1
Behavioral task
behavioral1
Sample
medik.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
medik.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
sign.exe
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
sign.exe
Resource
win10v2004-20231215-en
General
-
Target
c67d77bd0edc8993709148cae28d4d74
-
Size
30.7MB
-
MD5
c67d77bd0edc8993709148cae28d4d74
-
SHA1
ec452de2a9b753816cde035f25d02ef82e9fe1be
-
SHA256
14cf777abeedcd9f116f1aeb6362c8d0abb004f4eeb3f28e6e47280519637b2c
-
SHA512
decd0379248446aadacc5e61ece374d3d4c9b3520466b9bab8e20d39843d41e6a6706aa82ae0864f60562618527a29c51874861fb5f58b6be32fae5dc44ef60e
-
SSDEEP
786432:Yy15Kaebfb81qYzmYeJzAEp2mJVrvVx5B4FkAJs84:YyLKrbw8YzVedzrJjx/4Fvs84
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/medik.exe unpack001/sign.exe
Files
-
c67d77bd0edc8993709148cae28d4d74.zip
-
LEKARSTVA.blb
-
LEKARSTVA.dat
-
LEKARSTVA.idx
-
VRUZKA_MKB_LEK.dat
-
VRUZKA_MKB_LEK.idx
-
medik.exe.exe windows:4 windows x86 arch:x86
58f28baa7d748b451799ca57e96e02f9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
CharNextA
advapi32
RegCloseKey
oleaut32
SysFreeString
mpr
WNetOpenEnumA
version
VerQueryValueA
gdi32
Pie
ole32
IsEqualGUID
comctl32
ImageList_Add
imm32
ImmGetContext
winspool.drv
GetPrinterA
shell32
DragFinish
comdlg32
PrintDlgA
gdiplus
GdipFree
wsock32
send
winmm
PlaySoundA
crypt32
CertOpenStore
usp10
ScriptPlace
oledlg
OleUIObjectPropertiesA
Sections
.MPRESS1 Size: 6.5MB - Virtual size: 33.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
sign.exe.exe windows:5 windows x86 arch:x86
4c0f9b3d365a55f57cba2cf81407b652
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
GetProcAddress
oleaut32
SysFreeString
advapi32
RegCloseKey
user32
CharNextW
gdi32
Pie
version
VerQueryValueW
imagehlp
ImageDirectoryEntryToData
ole32
CoCreateGuid
comctl32
ImageList_Add
msvcrt
strchr
shell32
ShellExecuteW
wininet
InternetOpenW
comdlg32
PrintDlgW
winspool.drv
SetJobA
usp10
ScriptShape
winmm
PlaySoundW
crypt32
CertOpenStore
wsock32
send
fontsub
CreateFontPackage
oledlg
OleUIPasteSpecialW
gdiplus
GdipFree
Exports
Exports
Sections
.MPRESS1 Size: 15.8MB - Virtual size: 69.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE