d:\Program\Z+\Repos\Mahou\Mahou\obj\Release\Mahou.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2f1a8af2457feb18206524b153cc5c89e5a40cca7a6f9b9e81dcdc0f7026c081.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2f1a8af2457feb18206524b153cc5c89e5a40cca7a6f9b9e81dcdc0f7026c081.exe
Resource
win10v2004-20240419-en
General
-
Target
2f1a8af2457feb18206524b153cc5c89e5a40cca7a6f9b9e81dcdc0f7026c081
-
Size
633KB
-
MD5
429b88c17199b436261d797581ad0915
-
SHA1
38a7e4725ced08f60c3f619f89a37f75ca15358b
-
SHA256
2f1a8af2457feb18206524b153cc5c89e5a40cca7a6f9b9e81dcdc0f7026c081
-
SHA512
aa996e24d2d6b8dc0837659331967bf60dd5347b5b2bd1c1b78117bee4edf87c94f3534a0c5e71f8c32f86a6987387617c0679de6dbfa26a13a804d72a29f2ba
-
SSDEEP
6144:6nLr97Ayr2EhBjymVitkWs/31FYYgXqOXayA6B6nxgE14JZRvFXw2df9tiPXXiEZ:WLPBjym4sdFYbLAe6WEyXsn
Malware Config
Signatures
-
Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawPaste_URL -
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f1a8af2457feb18206524b153cc5c89e5a40cca7a6f9b9e81dcdc0f7026c081
Files
-
2f1a8af2457feb18206524b153cc5c89e5a40cca7a6f9b9e81dcdc0f7026c081.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 578KB - Virtual size: 577KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ