nIWt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d.exe
Resource
win10v2004-20240226-en
General
-
Target
62ed0ee9372f04bd637e3995624dbc0c.bin
-
Size
643KB
-
MD5
e62a2111a7e69314308103cc0494143f
-
SHA1
64394519c5f849e2d7b4fc14c1a4e35fff97625f
-
SHA256
0539e1d634e283f5d4d4d39439c3e60a58253c8e43bb6e6787917e5f307ed4dc
-
SHA512
5c2b141ac4f6c8ee36aec3c4e76a2992d63a819603b74ca18cf2fc309cec2569718dc01baddea8f3349b369b72bf8d8fec8d67e668499f56ab8fb7a617d83dab
-
SSDEEP
12288:n+i+VoR87fDhd/4U0t6OgUcvy0ivYQVptcTqJxma+2t/8gkcA+i6p3Ci0+XDJupH:n+i58T/z0t67Ucbiv9xc2Jx7+2t/E/5J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d.exe
Files
-
62ed0ee9372f04bd637e3995624dbc0c.bin.zip
Password: infected
-
17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 685KB - Virtual size: 684KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ