Static task
static1
Behavioral task
behavioral1
Sample
ef5cc39bd536f448498941d058596883d45a1f0c171ec0e6601c73d40671da3c.exe
Resource
win7-20240220-en
General
-
Target
ef5cc39bd536f448498941d058596883d45a1f0c171ec0e6601c73d40671da3c
-
Size
1.8MB
-
MD5
d933a1e34002d784b05aaf813e96bbca
-
SHA1
e22779e5665482f4f35fd5ab87d6075d9932b158
-
SHA256
ef5cc39bd536f448498941d058596883d45a1f0c171ec0e6601c73d40671da3c
-
SHA512
e7d2416680085f7cca918e353703d3c7087de72d17ce141db2c4eb77e1e727f195e913d4d7945908b698284bababde3a8a31367149e7f278254959e763bd4948
-
SSDEEP
49152:kiBbKIGjDt/gWtQ3MLeJZdbvmhS0gRAT18:j2IGdRCpbvmhS0g018
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef5cc39bd536f448498941d058596883d45a1f0c171ec0e6601c73d40671da3c
Files
-
ef5cc39bd536f448498941d058596883d45a1f0c171ec0e6601c73d40671da3c.exe windows:6 windows x86 arch:x86
2eabe9054cad5152567f0699947a2c5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpy
Sections
Size: 182KB - Virtual size: 408KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jlnctgua Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vtrtzzfm Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE