F:\Office\Target\x86\ship\postc2r\x-none\vpreview.pdb
Static task
static1
Behavioral task
behavioral1
Sample
58a57d7d1bdba7c8d1c13bc0140e2c3617ebbcc4be335d826e562b18150c69d8.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
58a57d7d1bdba7c8d1c13bc0140e2c3617ebbcc4be335d826e562b18150c69d8.exe
Resource
win10v2004-20240508-en
General
-
Target
58a57d7d1bdba7c8d1c13bc0140e2c3617ebbcc4be335d826e562b18150c69d8.exe
-
Size
1.2MB
-
MD5
120821c092cff1c007f7774599179580
-
SHA1
bf4bf6f73c6d9a3e97a61495f196644639b96e61
-
SHA256
58a57d7d1bdba7c8d1c13bc0140e2c3617ebbcc4be335d826e562b18150c69d8
-
SHA512
3380caa1edfc1f85e9fb36dd8356f21b4c0442e85ff3f927c8296836d502fe6bc542684f7f4b667c93dc02b562c0ed2cf1cbbdc6ef7eecfb55fcc6046564d291
-
SSDEEP
24576:ZEoym1uBv3nG1flT/1E6Ehg7mM+M6RkMkIM7gE6Eh67W:HUv3GnT30g7mM+M6RkMkIM7I067W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 58a57d7d1bdba7c8d1c13bc0140e2c3617ebbcc4be335d826e562b18150c69d8.exe
Files
-
58a57d7d1bdba7c8d1c13bc0140e2c3617ebbcc4be335d826e562b18150c69d8.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Sections
.text Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c2r Size: 512B - Virtual size: 300B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ