Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume3/FN-Progs/PL_Control_Neuhofer/Zusaetzlich/NetTool/NetTool.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume3/FN-Progs/PL_Control_Neuhofer/Zusaetzlich/NetTool/NetTool.exe
Resource
win10v2004-20240226-en
General
-
Target
NetTool.exe
-
Size
610KB
-
MD5
30668c8983077909935ff2a639015636
-
SHA1
e7f85a3e222a2326342824aca5ac3857fed9253f
-
SHA256
f7e614841c5cd2760a981b265f951fcdce70690d3f9339544461f9f1e3b3be49
-
SHA512
9e53a1e2ee356e1fa4eb75d6f042e42f99b313b029424417e0c83766e57cd530a4d4543dd23634377089b518bb909f1e905fc267e89cf04e3362d06d944254e8
-
SSDEEP
12288:RJom+p4LvYB3CCpgOs65QeKaHL82V9Uv9UTTr3s9ZP7eb/aE:R+pXB3pgOs65QXalGUf7s9g/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Device/HarddiskVolume3/FN-Progs/PL_Control_Neuhofer/Zusaetzlich/NetTool/NetTool.exe
Files
-
NetTool.exe.zip
Password: Infected$12345
-
Device/HarddiskVolume3/FN-Progs/PL_Control_Neuhofer/Zusaetzlich/NetTool/NetTool.exe.exe windows:4 windows x86 arch:x86
Password: Infected$12345
709ca414d7a64ef721e7795cfad68402
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
CharNextA
advapi32
RegCloseKey
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
SaveDC
ole32
OleDraw
comctl32
ImageList_Add
winspool.drv
OpenPrinterA
shell32
ShellExecuteA
comdlg32
GetSaveFileNameA
msimg32
GradientFill
wsock32
htons
iphlpapi
SendARP
Sections
.MPRESS1 Size: 622KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
manifest.json