Static task
static1
Behavioral task
behavioral1
Sample
RFQ_4183321000004562E20000.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RFQ_4183321000004562E20000.exe
Resource
win10v2004-20240508-en
General
-
Target
4900b43d5fd24f95b56bc3777deeeb6d972f0e7863b988620bfb65bf48a6f2b2.gz
-
Size
338KB
-
MD5
135c25512bb1af6b4ca2c9512e8e748f
-
SHA1
8b6cfe5f7223515d8a57a038ff68bb0c9cb2f5c8
-
SHA256
4900b43d5fd24f95b56bc3777deeeb6d972f0e7863b988620bfb65bf48a6f2b2
-
SHA512
5128660d21ae3e2404fe4014bf10ef3f8eeef6867900c30402a0af4eb87044363f014aae7a8abdd8bc590991386a99fbe7dd9f0574f2a0ffa83e7216c4286801
-
SSDEEP
3072:HQgbx0G/FnwEtwpC3j0MgcnazriScqZNTvQVFmf6IlOd1A0kyA1wrcyWQut1:HBekBF3aTqfALciMdSWA2cyDut1
Malware Config
Signatures
-
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule static1/unpack002/RFQ_4183321000004562E20000.exe INDICATOR_EXE_Packed_SmartAssembly -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack002/RFQ_4183321000004562E20000.exe
Files
-
4900b43d5fd24f95b56bc3777deeeb6d972f0e7863b988620bfb65bf48a6f2b2.gz.gz
-
sample.tar
-
RFQ_4183321000004562E20000.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 395KB - Virtual size: 395KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ