Static task
static1
Behavioral task
behavioral1
Sample
b9680d8e2432301e9626ea6e2cf95049f34c4f1a7332c3d6d02f571ab41ef888.exe
Resource
win7-20240220-en
General
-
Target
b9680d8e2432301e9626ea6e2cf95049f34c4f1a7332c3d6d02f571ab41ef888.exe
-
Size
242KB
-
MD5
d7c6f170f3b448d417b71c65addb6b33
-
SHA1
ba31e862e1d2606ee2ebdc91b03d5c96705a8499
-
SHA256
b9680d8e2432301e9626ea6e2cf95049f34c4f1a7332c3d6d02f571ab41ef888
-
SHA512
b39bee3a147e3593c55bb40510f4794a53aa266c9c9db7a3e74e4140dabf593fb108f32fb08a540821fc4b9556d453b47551adf2462d6ff5a8cfe58daa1097bc
-
SSDEEP
6144:EIjKgggMnaOAXf/qSDa9keprqZESPiwgt/KCiITy1VQI:EIjKd3WXfinD5e1iwgYCiITy1Vt
Malware Config
Signatures
-
Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_ConfuserEx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9680d8e2432301e9626ea6e2cf95049f34c4f1a7332c3d6d02f571ab41ef888.exe
Files
-
b9680d8e2432301e9626ea6e2cf95049f34c4f1a7332c3d6d02f571ab41ef888.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
*;-oM4? Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ