Static task
static1
Behavioral task
behavioral1
Sample
Ажурирање документације ФРКС-В201.0224034370.xlsx.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Ажурирање документације ФРКС-В201.0224034370.xlsx.exe
Resource
win10v2004-20240419-en
General
-
Target
16942556838.zip
-
Size
1.8MB
-
MD5
20124d9cc94bd0ff654fdcd968a491ac
-
SHA1
b4b14919ce873323c40aab62f1498812ac820f08
-
SHA256
70dc16a7a405f69888be5061308da23037102d0de8f9aaee9a690591da805939
-
SHA512
201b10db24eebb3b658676876babe0000ac9771b3a889001aa958efadd10036d4ed8f7b52a76006dff2f797f84cc532b5877c249633d52b76325fa883efa3bf3
-
SSDEEP
49152:lrjpZDSAA8zoIlpJgFfuSprk4FREBkicGDrq3p5w6rBa:lrjbRxzL82Sprk4DdiBDGkgBa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack002/Ажурирање документације ФРКС-В201.0224034370.xlsx.exe
Files
-
16942556838.zip.zip
Password: infected
-
d263511e637aaef2425e4aaf44d221710ea6b567cb72367d861082bc116ed367.rar
Password: infected
-
Ажурирање документације ФРКС-В201.0224034370.xlsx.exe.exe windows:4 windows x64 arch:x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ