Static task
static1
Behavioral task
behavioral1
Sample
f3a9c8045223ad668db8f15e8ff4a85ad262da603ad8ed11247a469e0622d694.exe
Resource
win7-20240508-en
General
-
Target
f3a9c8045223ad668db8f15e8ff4a85ad262da603ad8ed11247a469e0622d694.exe
-
Size
96KB
-
MD5
b31f770f36a3a6169d94e72f56dc048f
-
SHA1
e1a4f34c89100d199b00c2127f8d706375099018
-
SHA256
f3a9c8045223ad668db8f15e8ff4a85ad262da603ad8ed11247a469e0622d694
-
SHA512
efcf30d3f8be2cbfece28d5bd514bbcdc8502961e8f977e5642307ef2df07ac476cc2e1aff989a58501b2048cca2db7f321c7615346099554c64b114a6044744
-
SSDEEP
1536:HDtE9ZDLm65cpGJUzZy1eQmI0aa7gD5jxWhGEIhISwEKCC0Km:HZEhcpGY4mI0w5dWhGE8wEKCC8
Malware Config
Signatures
-
Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f3a9c8045223ad668db8f15e8ff4a85ad262da603ad8ed11247a469e0622d694.exe
Files
-
f3a9c8045223ad668db8f15e8ff4a85ad262da603ad8ed11247a469e0622d694.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ