Static task
static1
Behavioral task
behavioral1
Sample
d8398e13bf3e4dc54eca9064917f41f54e7fdc84f22039a70e2da5e3b8d42316.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
d8398e13bf3e4dc54eca9064917f41f54e7fdc84f22039a70e2da5e3b8d42316.exe
Resource
win10v2004-20240508-en
General
-
Target
d8398e13bf3e4dc54eca9064917f41f54e7fdc84f22039a70e2da5e3b8d42316.exe
-
Size
4.5MB
-
MD5
dcc79a1f3f9e60ee240e76c95146c391
-
SHA1
020b3af6594ac2fa1f4e2881b5f60a1c6a12c1c2
-
SHA256
d8398e13bf3e4dc54eca9064917f41f54e7fdc84f22039a70e2da5e3b8d42316
-
SHA512
92082a38bf7aa7de6466da0864f0ecbd5c3667ef017db8a97b45966f892e94cae80526f7c5069b6144b9891dadbaa179b295e6f1f7087255622e3fee5aae28e3
-
SSDEEP
24576:j4rk/0VJT8Z8+tJWn3+UQ7S6YPxDwb1LcoHH7vcNVWJ4s/gZql7/pIZe63AbX5Bw:jOk/s
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d8398e13bf3e4dc54eca9064917f41f54e7fdc84f22039a70e2da5e3b8d42316.exe
Files
-
d8398e13bf3e4dc54eca9064917f41f54e7fdc84f22039a70e2da5e3b8d42316.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 4.5MB - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ