Behavioral task
behavioral1
Sample
600694fa52aa0bd711a6d564728931380bd29891fdf62c26b1f95224589b78d8.exe
Resource
win10v2004-20240508-en
General
-
Target
600694fa52aa0bd711a6d564728931380bd29891fdf62c26b1f95224589b78d8
-
Size
149KB
-
MD5
81740342d64bc105d369f39bcf23e93f
-
SHA1
4d5d266bc24ed969108c68f794883957a22ae939
-
SHA256
600694fa52aa0bd711a6d564728931380bd29891fdf62c26b1f95224589b78d8
-
SHA512
3be9e90c67ef641b94f81c86344082b63c690e906a1fed7825bb6a0321cd4c8289d8e64e9583897ce832cad137f475e66053ace4d43f2b6a741d33b3709ead91
-
SSDEEP
3072:HemwkmgMXfbtdBE2a/duEx5cLbfu3/XcW5DC2kgZ8YfHcvOgbg8vW/f:HfmgMXfbtdK2a/dh5cLeC2kgZ8YfHcv/
Malware Config
Signatures
-
Detect Xehook Payload 1 IoCs
Processes:
resource yara_rule sample family_xehook -
Xehook family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 600694fa52aa0bd711a6d564728931380bd29891fdf62c26b1f95224589b78d8
Files
-
600694fa52aa0bd711a6d564728931380bd29891fdf62c26b1f95224589b78d8.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 812B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ