Static task
static1
Behavioral task
behavioral1
Sample
5422e01247be9b0e29385bab31141d03f7fe3b48e3574c49c4e6d19ad400956e.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5422e01247be9b0e29385bab31141d03f7fe3b48e3574c49c4e6d19ad400956e.exe
Resource
win10v2004-20240419-en
General
-
Target
5422e01247be9b0e29385bab31141d03f7fe3b48e3574c49c4e6d19ad400956e
-
Size
141KB
-
MD5
41eb0b6c38066a8dbe4e13b12dd8f291
-
SHA1
3c3ab482e3a3751ab3fda398d7a661c474d55db6
-
SHA256
5422e01247be9b0e29385bab31141d03f7fe3b48e3574c49c4e6d19ad400956e
-
SHA512
0889e812a04d0de9db297b8d604397a6890e659d98d6692bbc56222057eb9bfd3db0cce553b52afee46961ec1c536c3830aaced864dac4495bbf959a42faf10b
-
SSDEEP
3072:gOuCgsQ+rTjPQopsX2VEAhHMsuJmQWZmvwEfj9:OYPVg2nhHvQWZ74j9
Malware Config
Signatures
-
Detects executables packed with RLPACK 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_RLPack -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5422e01247be9b0e29385bab31141d03f7fe3b48e3574c49c4e6d19ad400956e
Files
-
5422e01247be9b0e29385bab31141d03f7fe3b48e3574c49c4e6d19ad400956e.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.packed Size: - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.RLPack Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE