Overview
overview
10Static
static
315906709596.zip
windows7-x64
115906709596.zip
windows10-2004-x64
172b215512d...85.eml
windows7-x64
572b215512d...85.eml
windows10-2004-x64
3Atlas.jpg
windows7-x64
3Atlas.jpg
windows10-2004-x64
3Vessel Par...rs.zip
windows7-x64
1Vessel Par...rs.zip
windows10-2004-x64
1Vessel Par...rs.exe
windows7-x64
10Vessel Par...rs.exe
windows10-2004-x64
10email-html-1.html
windows7-x64
1email-html-1.html
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
15906709596.zip
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
15906709596.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
72b215512ddbb91f039113853f803b2d01eb4824a0e04209d4576170a9499385.eml
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
72b215512ddbb91f039113853f803b2d01eb4824a0e04209d4576170a9499385.eml
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Atlas.jpg
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
Atlas.jpg
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Vessel Particulars.zip
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Vessel Particulars.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Vessel Particulars.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Vessel Particulars.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
email-html-1.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
email-html-1.html
Resource
win10v2004-20240226-en
General
-
Target
15906709596.zip
-
Size
476KB
-
MD5
6c8eff489dd373f54fc65ce1807985db
-
SHA1
aaa870b72ec8317b384dfa5df337241689a531d2
-
SHA256
4de846329e268ccc34b89af1630f8b33b13a7a7166cd7e2eb37bc313b64d9a6f
-
SHA512
74c4331eecc856238b482f00e897b86677603d1e29c09c44c1fd42a493a21b7936c1a032062eb8e970395ec6c90fdfb2d4346f1516b02ce1fd0c036657957829
-
SSDEEP
12288:HPatBW3LkUXa/f7GRtiIDt5+U/Wl1nLEPhU73A/O:HPatY7kUXef7aiIDt55/WzQPOcm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack004/Vessel Particulars.exe
Files
-
15906709596.zip.zip
Password: infected
-
72b215512ddbb91f039113853f803b2d01eb4824a0e04209d4576170a9499385.eml
Password: infected
-
Atlas.jpg.jpg
Password: infected
-
Vessel Particulars.zip.zip
Password: infected
-
Vessel Particulars.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 694KB - Virtual size: 693KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
email-html-1.txt.html