Static task
static1
Behavioral task
behavioral1
Sample
7e7421242a8fb16079396781c95b1f48abb50ed8f2e7dde91f8055e0cb83a8a8.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7e7421242a8fb16079396781c95b1f48abb50ed8f2e7dde91f8055e0cb83a8a8.exe
Resource
win10v2004-20240226-en
General
-
Target
7e7421242a8fb16079396781c95b1f48abb50ed8f2e7dde91f8055e0cb83a8a8
-
Size
467KB
-
MD5
9a43e78ef92f80238749dd2069de57bc
-
SHA1
805a805e3f95a464c02e131c45a4465643ba484d
-
SHA256
7e7421242a8fb16079396781c95b1f48abb50ed8f2e7dde91f8055e0cb83a8a8
-
SHA512
a3ed3fc76914ae22f3e7d3638c2867905878f0c9d4e3286ed7a0eeb30c3df97bdeb37dbe43c9c451d9ee85d736820c6263484f7bffdd651df10717de90ba3e06
-
SSDEEP
6144:OG7rKj/JaIO7Mud+EwLAWwRiawKIgcHFfxOCn5VBfsZBrcH1Uyh0WW0ZynCqF:OiKjBatQK+EwLSEaoHFfx/5VBfwqxaF
Malware Config
Signatures
-
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7e7421242a8fb16079396781c95b1f48abb50ed8f2e7dde91f8055e0cb83a8a8
Files
-
7e7421242a8fb16079396781c95b1f48abb50ed8f2e7dde91f8055e0cb83a8a8.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.APX0 Size: - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.APX1 Size: 388KB - Virtual size: 387KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ