Static task
static1
Behavioral task
behavioral1
Sample
53429c196efbf13804b4bb5b48a9a073e1992d9e27a47f8361b6a8b38dc7f199.exe
Resource
win7-20240221-en
General
-
Target
53429c196efbf13804b4bb5b48a9a073e1992d9e27a47f8361b6a8b38dc7f199
-
Size
3.0MB
-
MD5
a88169e2a7b8cf53b762374c038cc29a
-
SHA1
03d36099aaa7a2e2271da427dc4289e97e9af513
-
SHA256
53429c196efbf13804b4bb5b48a9a073e1992d9e27a47f8361b6a8b38dc7f199
-
SHA512
5e82a71a594e6d3b3a96ef4f05992729ef75e683a507c06d81c15533a5f251406b8f6888a1161c36093eba82b3e752a36099867751e8f45fb26790e0fbcd1084
-
SSDEEP
49152:vTXmfa0fA77EhQh/ryTxjdnzqdR8bq644IjdnzqehLqTKrLf3zRG1uz:vqfa6m7Eah/+nnzqdIenzqekKrjDQQz
Malware Config
Signatures
-
Detects executables packed with Babel 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Babel -
Detects executables packed with Dotfuscator 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Dotfuscator -
Detects executables packed with Goliath 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Goliath -
Detects executables packed with SmartAssembly 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_SmartAssembly -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 53429c196efbf13804b4bb5b48a9a073e1992d9e27a47f8361b6a8b38dc7f199
Files
-
53429c196efbf13804b4bb5b48a9a073e1992d9e27a47f8361b6a8b38dc7f199.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
;* N Size: 949KB - Virtual size: 948KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ