Static task
static1
Behavioral task
behavioral1
Sample
POT9876540009865.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
POT9876540009865.exe
Resource
win10v2004-20240426-en
General
-
Target
POT9876540009865.cmd
-
Size
1.1MB
-
MD5
3f090151eabfcea91b663d395c148dee
-
SHA1
f18d552111a8f034055cf5c165d9370af83b247b
-
SHA256
05e6b3a937592100deb5cb064834821eb9cdf994f610b2398302ab3ddca8dbcd
-
SHA512
a81683a0d62c7038c2a0590ac3da4d54dfb2301cbb94b537daceaebe58d2a530f4d1455a18c4f26ea1bc73b9406476708be01fff8779667ed1a5c6611433bad8
-
SSDEEP
24576:qSu1S82mBVrIiudqIDyeJBilZqkAzUHl7C:qSuU82mTVeHiikAzUH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource POT9876540009865.cmd
Files
-
POT9876540009865.cmd.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ