Static task
static1
Behavioral task
behavioral1
Sample
ecb1e141d645db6da20ead3b5a9710778fa33427fde5ea916ab088e843681878.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ecb1e141d645db6da20ead3b5a9710778fa33427fde5ea916ab088e843681878.exe
Resource
win10v2004-20240226-en
General
-
Target
ecb1e141d645db6da20ead3b5a9710778fa33427fde5ea916ab088e843681878.exe
-
Size
811KB
-
MD5
38a7d47290ac9256321dfe8b2d4e3130
-
SHA1
2097e0a4dbae4b8ac0360c441c716a69c1bced7f
-
SHA256
ecb1e141d645db6da20ead3b5a9710778fa33427fde5ea916ab088e843681878
-
SHA512
cb72a9c60fa114cbf6f553972d97176bf4315bc5b1bf39de22644bd36ae2e10968fd1fc89947204decf6532234d4548221c11302780d150160ae677aee331bc7
-
SSDEEP
12288:kKIIhtQY47i/eIFdRgbE1ooBQdpW3Ari4VVyZC0+1cXOoxPRq/6:kCaY4gFdRgbiooBQd3iE0n/xa6
Malware Config
Signatures
-
Detects executables containing bas64 encoded gzip files 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ecb1e141d645db6da20ead3b5a9710778fa33427fde5ea916ab088e843681878.exe
Files
-
ecb1e141d645db6da20ead3b5a9710778fa33427fde5ea916ab088e843681878.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 809KB - Virtual size: 808KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ