Static task
static1
Behavioral task
behavioral1
Sample
b606d749bf5f7413ff47e204a52e8c569769c31488fbf3314164e099be716273.exe
Resource
win7-20240221-en
General
-
Target
b606d749bf5f7413ff47e204a52e8c569769c31488fbf3314164e099be716273
-
Size
7.5MB
-
MD5
63c8ca82782394d64480ae8899436813
-
SHA1
df15613222d12d87e2500c8852c28b892baf2d1a
-
SHA256
b606d749bf5f7413ff47e204a52e8c569769c31488fbf3314164e099be716273
-
SHA512
6e0fab1140a71bf9c044cc86e1dc5cce8622d8b59e96d867d6ad65d0aa803b5c6339a1efa70c8b63e08bc360423e7e406b42d67746e24fc4cbfc9704ce75ccfb
-
SSDEEP
98304:4YAiAfllocqh7HImaldnMI/0VWaM0TzCKlFfKPY7deA9SoruABAnr3RzyxeqB3o+:4Df4/+bMI/0VdMYzfVIRzI/tFpj
Malware Config
Signatures
-
Detects executables manipulated with Fody 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Fody -
Detects executables packed with Babel 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Babel -
Detects executables packed with Dotfuscator 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Dotfuscator -
Detects executables packed with Goliath 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Goliath -
Detects executables packed with SmartAssembly 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_SmartAssembly -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b606d749bf5f7413ff47e204a52e8c569769c31488fbf3314164e099be716273
Files
-
b606d749bf5f7413ff47e204a52e8c569769c31488fbf3314164e099be716273.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
9i&(] Size: 150KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tFGJ Size: 512B - Virtual size: 134B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
<RNzOV> Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.null Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ