Static task
static1
Behavioral task
behavioral1
Sample
5d9a5c61f0ef143449fa486e4582ddaf6039de6ef285237e9aeb820abff63b27.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5d9a5c61f0ef143449fa486e4582ddaf6039de6ef285237e9aeb820abff63b27.exe
Resource
win10v2004-20240412-en
General
-
Target
5d9a5c61f0ef143449fa486e4582ddaf6039de6ef285237e9aeb820abff63b27.exe
-
Size
634KB
-
MD5
f456a7fd78b0dd10acb421279b377a5b
-
SHA1
72bf459006eb21941bb95a26bbfe295dd0112a66
-
SHA256
5d9a5c61f0ef143449fa486e4582ddaf6039de6ef285237e9aeb820abff63b27
-
SHA512
1789c891abfb1bdc35b8623029d80e599b073661e53faf6afc7b5ff0a47f68a2dfa182165d75f9f0fa140cba7d4d3eaffe75d9086926b235ff661dd3c250f7ac
-
SSDEEP
12288:yDIoaj/5eh148RQedp5bu9TlLfUTdwq1pdUWPBBT:Fti4c5vbuhZUTdFrPP
Malware Config
Signatures
-
Detects executables manipulated with Fody 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Fody -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d9a5c61f0ef143449fa486e4582ddaf6039de6ef285237e9aeb820abff63b27.exe
Files
-
5d9a5c61f0ef143449fa486e4582ddaf6039de6ef285237e9aeb820abff63b27.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 631KB - Virtual size: 631KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ