Static task
static1
Behavioral task
behavioral1
Sample
cea44bc4e2463318a1a3f36458a731c1f9b3c4002b6e24ed0d9b85ca09801ef9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cea44bc4e2463318a1a3f36458a731c1f9b3c4002b6e24ed0d9b85ca09801ef9.exe
Resource
win10v2004-20240611-en
General
-
Target
c847ef29b2552377e37be45bc8ebce35.bin
-
Size
209KB
-
MD5
b1544567a860c299bf915339e9ee2175
-
SHA1
c16875c1e19389924e285fc92d63f8a0df017c0e
-
SHA256
34e06a795306a92b82eb1f98705080ae5ce11ff09f0f1a3a47c39c2ca99953f5
-
SHA512
56b2ff893bdc6d660cc703c1c259585b08e38dd6ab7ae39d25693bbf8cb746b981ebd5fc4e3fc8a8970b9e5645b21fd32ca7589d9986042259aec65ae815e1a0
-
SSDEEP
3072:RiFfmRVVTUU8+lTxnGtMYK5A8EzOJk5keAJ7NL+4sDslC9XH2IZWu4I0h+:cCVVTUKTGtMp5Alv4+3XH2IY+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cea44bc4e2463318a1a3f36458a731c1f9b3c4002b6e24ed0d9b85ca09801ef9.exe
Files
-
c847ef29b2552377e37be45bc8ebce35.bin.zip
Password: infected
-
cea44bc4e2463318a1a3f36458a731c1f9b3c4002b6e24ed0d9b85ca09801ef9.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
A-(uCT Size: 186KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ