Static task
static1
Behavioral task
behavioral1
Sample
7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f.exe
Resource
win10v2004-20240226-en
General
-
Target
7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f.exe
-
Size
1.8MB
-
MD5
a827a96f84fd96ff687d1011c924ff12
-
SHA1
b7c77ebf0dd9b9276ffa980d19a18d1b38cccac0
-
SHA256
7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f
-
SHA512
0bd5643d74c9bd673eacd89e2356596dad638d116b0e6022fcbb462b60609686675ca7f1c93fa6820ee2c6d964bdf085894374a62a401ca056591339f86180f8
-
SSDEEP
24576:c7Zs3/D1H+cZvKUfcr/hL5Jr/wrFcCZHEbbNEZrKEKe3X:cVsPD1NZbYJ5Jr4Jc8kbikEKe3
Malware Config
Signatures
-
Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_ConfuserEx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f.exe
Files
-
7f5c96ca278229949de22c06aaf092e73ffdad1e96230261017ce52f1691d03f.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
bAi:l Size: 1015KB - Virtual size: 1015KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 786KB - Virtual size: 786KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ