Static task
static1
Behavioral task
behavioral1
Sample
c953868e9894fe9ed91324a8eb050dc76564dc553e4094b5797a392600c4e6c7.exe
Resource
win7-20240221-en
General
-
Target
c953868e9894fe9ed91324a8eb050dc76564dc553e4094b5797a392600c4e6c7
-
Size
100KB
-
MD5
79ff711c11200ddc0176f3adee4326a5
-
SHA1
2ebe263f1c1014dd8f093d1ed1ac3e735cc47826
-
SHA256
c953868e9894fe9ed91324a8eb050dc76564dc553e4094b5797a392600c4e6c7
-
SHA512
55cc28ee3f2784d5a397a4602b330bf988e360448ef9091cfbfb19ebdc66cadfb97ca1bedbcd9334b68adbb491b36636fe010c21e3ad79e2e3a0934394e85b6f
-
SSDEEP
3072:21JJVmDYK4PspM3Y4bVzBmNbKq3Zf9/taX:21J3WdM37MnZb
Malware Config
Signatures
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_SimplePolyEngine -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c953868e9894fe9ed91324a8eb050dc76564dc553e4094b5797a392600c4e6c7
Files
-
c953868e9894fe9ed91324a8eb050dc76564dc553e4094b5797a392600c4e6c7.exe windows:4 windows x86 arch:x86
14610dd0ebbc796a9a3a2ba2cdd24e79
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
user32
MessageBoxW
Sections
.text Size: 68KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE