Static task
static1
Behavioral task
behavioral1
Sample
RFQ_6129000001290004500.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
RFQ_6129000001290004500.exe
Resource
win10v2004-20240508-en
General
-
Target
aaaaaa.tgz
-
Size
169KB
-
MD5
245a8175c789c4d3c5653af9567662fa
-
SHA1
837535b6a1d218948b8dad698e11c253644945c4
-
SHA256
fdc1f260ca74a4e65e8b6a9753d34d3b2bba8e5eaeed728636dee33ce5bda7c9
-
SHA512
9b7c2efa06c18b8ac05a62cddfffc1b482450b31f64d84a5cdea035115ed6da4bba17b204f19acf393702737a802d83e041769ddcd0d1ce0063cde6ee8fe840e
-
SSDEEP
384:VVo0RvX7Lrx61U01uIfwhDneu4RXgZjgY+pSxnCxmHKFUKberW6VYUma+hWVIS:Q0l1cU04JiD1KgVpuCxhFN6XjYhfS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/RFQ_6129000001290004500.exe
Files
-
aaaaaa.tgz.gz
-
sample.tar
-
RFQ_6129000001290004500.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ