Static task
static1
Behavioral task
behavioral1
Sample
海典导配送单.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
海典导配送单.exe
Resource
win10v2004-20240508-en
General
-
Target
海典导配送单.exe
-
Size
388KB
-
MD5
53732a771cb59be28f3ee9a696ee31fe
-
SHA1
6714cb424ed39da20985a46fab774c8bfe58d5c0
-
SHA256
1c51d7f4229c33fc3f94dffe32809318a8cedb386286d44d748c6001f4009112
-
SHA512
9004051b590e47141f15c209b4cd07b1421bcf7663b1c6c41f4548c6c14595495c60eed903505a04da9d19943250e07c4d4f6b765e4bfd697afa250926d47374
-
SSDEEP
6144:fwNfnZY618A6X8GOaZ+wvj83jMLwYVEigNr+rut9RTts3h6O1a2qmvI2L:fwxZ589XMaZNL83jGwQEjNrV9Xs0813
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 海典导配送单.exe
Files
-
海典导配送单.exe.exe windows:5 windows x64 arch:x64
d0b576aa1597bfc88eef11f7320a63ec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
wsock32
__WSAFDIsSet
version
VerQueryValueW
winmm
timeGetTime
comctl32
ImageList_Remove
mpr
WNetUseConnectionW
wininet
FtpOpenFileW
psapi
GetProcessMemoryInfo
iphlpapi
IcmpSendEcho
userenv
LoadUserProfileW
uxtheme
IsThemeActive
user32
GetDC
gdi32
LineTo
comdlg32
GetSaveFileNameW
advapi32
AddAce
shell32
DragFinish
ole32
CoGetObject
oleaut32
SysStringLen
Sections
.MPRESS1 Size: 334KB - Virtual size: 988KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE