Static task
static1
Behavioral task
behavioral1
Sample
fdb39101ac51aa37414bb9afc567ac9dd94ad1b871180979919d84d64cd61951.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fdb39101ac51aa37414bb9afc567ac9dd94ad1b871180979919d84d64cd61951.exe
Resource
win10v2004-20240508-en
General
-
Target
fdb39101ac51aa37414bb9afc567ac9dd94ad1b871180979919d84d64cd61951
-
Size
9.5MB
-
MD5
40485372ba77b563b5d01d7d3ceae5a3
-
SHA1
34950b9c1636416dd77a2eb70233a065f559afb2
-
SHA256
fdb39101ac51aa37414bb9afc567ac9dd94ad1b871180979919d84d64cd61951
-
SHA512
477fbb8663c449799b841aed55dfbb184eab192077e14fb54680a3fec68abdf826e3aba86d1fa26c48dd8167647f44ecafd9130716460ec89c6ea9f093d823ad
-
SSDEEP
98304:U4N6tFKUgTH2M2m9UMpu1QfLczqssnKSk6vKRuy5a667:R6tLgTH2qBpu1QfLIqsufk6vqH67
Malware Config
Signatures
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
Detects executables packed with MEW 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_MEW -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fdb39101ac51aa37414bb9afc567ac9dd94ad1b871180979919d84d64cd61951
Files
-
fdb39101ac51aa37414bb9afc567ac9dd94ad1b871180979919d84d64cd61951.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
MEW Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�uۊ�� Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE