Static task
static1
Behavioral task
behavioral1
Sample
9d75da949124ea4a6b6043522f09c97d7da1d4ea10ecb1a923d739e2f10a3564.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d75da949124ea4a6b6043522f09c97d7da1d4ea10ecb1a923d739e2f10a3564.exe
Resource
win10v2004-20240412-en
General
-
Target
9d75da949124ea4a6b6043522f09c97d7da1d4ea10ecb1a923d739e2f10a3564
-
Size
24KB
-
MD5
108a1ce4f12fc3321316833b44fe801d
-
SHA1
143c51149b1f100015407bf840be2ce928d99766
-
SHA256
9d75da949124ea4a6b6043522f09c97d7da1d4ea10ecb1a923d739e2f10a3564
-
SHA512
7abc936b8cf340a7a625f480d1e39f541fdf861bee0eeb14de3cb0d0cd1cf2628c78709bf9592cf57a722aa08877ab557c88d0a0c62e0d2acb4a5825e633c68b
-
SSDEEP
96:28vEwnhVCVhPXFFhYUFA6GKEo2EKvkwqyjpXi0:28zeTdxFDY3kwrjpXi0
Malware Config
Signatures
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_SimplePolyEngine -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d75da949124ea4a6b6043522f09c97d7da1d4ea10ecb1a923d739e2f10a3564
Files
-
9d75da949124ea4a6b6043522f09c97d7da1d4ea10ecb1a923d739e2f10a3564.exe windows:4 windows x86 arch:x86
14610dd0ebbc796a9a3a2ba2cdd24e79
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
user32
MessageBoxW
Sections
.text Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE