Static task
static1
Behavioral task
behavioral1
Sample
d8cbbb545c3b804cd8ac1f861b18852761a987693650478fb01ae98538df9741.exe
Resource
win7-20240221-en
General
-
Target
913ffffe973462ca717e6d6a35435f05.bin
-
Size
2.3MB
-
MD5
85971411b20a7fdb6e90ff268614f53b
-
SHA1
8e7bbd9892f194634d902ba7b5580f530d9f2bcf
-
SHA256
00058eb4fb0f99a87f3b6d186cc4928497aad4d585feb0409c17a93e1e50d839
-
SHA512
ef67e29a5fe0ba5733e44d2c0337632fd9cf1beb64736719b01555e0895329c2ba4adbfe3d4e88d9f7ad543c0a99314accb5ab4256c06fbf5f4ada921f503092
-
SSDEEP
49152:+eCzrb9MTwQxKdKCz2sVL6PZJ4XE4u4mz7wlgh06JkH8QHFU+zJi175jBc:OMvKdhgPZJj4u4mt0YpOG3h5m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d8cbbb545c3b804cd8ac1f861b18852761a987693650478fb01ae98538df9741.exe
Files
-
913ffffe973462ca717e6d6a35435f05.bin.zip
Password: infected
-
d8cbbb545c3b804cd8ac1f861b18852761a987693650478fb01ae98538df9741.exe.exe windows:5 windows x86 arch:x86
Password: infected
c400e59b564e8c451299e3dea65fffb9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_EH_prolog
kernel32
IsProcessorFeaturePresent
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
wsprintfW
advapi32
RegGetValueA
shell32
SHFileOperationA
ole32
CoSetProxyBlanket
oleaut32
VariantInit
shlwapi
ord155
crypt32
CryptStringToBinaryA
Sections
.text Size: - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmpn�� Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmpn�� Size: 1024B - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmpn�� Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ