TMethodImplementationIntercept
Static task
static1
Behavioral task
behavioral1
Sample
medik.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
medik.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
sign.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
sign.exe
Resource
win10v2004-20240226-en
General
-
Target
d3df90cb532c8478a5108134c21bc522
-
Size
20.2MB
-
MD5
d3df90cb532c8478a5108134c21bc522
-
SHA1
34ad5ca7f4251cfa6c7c9b2fd96bb922c47d14b3
-
SHA256
a51918919334c7a2f3d74b9a171a35a04754c625f0229227f113d05c48824bc6
-
SHA512
be1814c70643e4768391ca271797d74638ca0c0e1c6bc4298336a6d642ef5998eafe8388d6358b2829e05b7ec799cbe6b7ce3424a9e404914e8aa023c237ef8d
-
SSDEEP
393216:K+g3Llmae1DcOHzHgjWEXU6s0cNPFRlqVkVmsUlyjYR3HWXd3MSu3aA2:54qZcOH8jW0U6shNHlSJsUlhW3MxaD
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/medik.exe unpack001/sign.exe
Files
-
d3df90cb532c8478a5108134c21bc522.zip
-
medik.exe.exe windows:4 windows x86 arch:x86
4fad4fe11b25ec0e8d73111dd3cc802e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
CharNextA
advapi32
RegCloseKey
oleaut32
SysFreeString
mpr
WNetOpenEnumA
version
VerQueryValueA
gdi32
Pie
msimg32
TransparentBlt
ole32
CoCreateGuid
comctl32
ImageList_Add
imm32
ImmGetContext
winspool.drv
WritePrinter
shell32
DragFinish
comdlg32
PrintDlgA
winmm
PlaySoundA
wsock32
send
usp10
ScriptPlace
Sections
.MPRESS1 Size: 4.4MB - Virtual size: 18.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
sign.exe.exe windows:5 windows x86 arch:x86
4c0f9b3d365a55f57cba2cf81407b652
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
GetProcAddress
oleaut32
SysFreeString
advapi32
RegCloseKey
user32
CharNextW
gdi32
Pie
version
VerQueryValueW
imagehlp
ImageDirectoryEntryToData
ole32
CoCreateGuid
comctl32
ImageList_Add
msvcrt
strchr
shell32
ShellExecuteW
wininet
InternetOpenW
comdlg32
PrintDlgW
winspool.drv
SetJobA
usp10
ScriptShape
winmm
PlaySoundW
crypt32
CertOpenStore
wsock32
send
fontsub
CreateFontPackage
oledlg
OleUIPasteSpecialW
gdiplus
GdipFree
Exports
Exports
Sections
.MPRESS1 Size: 15.8MB - Virtual size: 69.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE