Behavioral task
behavioral1
Sample
dedbedb38fa12fd46a1d15c72113b7c1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dedbedb38fa12fd46a1d15c72113b7c1.exe
Resource
win10v2004-20240226-en
General
-
Target
dedbedb38fa12fd46a1d15c72113b7c1
-
Size
3.3MB
-
MD5
dedbedb38fa12fd46a1d15c72113b7c1
-
SHA1
d1e968bc4f51f7dc1b8bf64e8131d977b15436eb
-
SHA256
457da0fc802700e6a8812cf0b21cce40b87a0ae194bae0cb8bf7d25997f948f0
-
SHA512
a92f52a4b071d99011aadbc9bf3bd467ebc0f94bbbebca201b7d67f624da3257f84ed549e07a458b23e813e831f5c082d81ad5d0921a893260bc32021f9b8a73
-
SSDEEP
98304:aQ7Eu3QIMTHC7fLM+iLRo5I24d6Yd4S+D845wVmE8G4T2O:aOqTHiZiVo5IBd4r845wVmE94Tr
Malware Config
Extracted
gozi
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dedbedb38fa12fd46a1d15c72113b7c1
Files
-
dedbedb38fa12fd46a1d15c72113b7c1.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 1.4MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ