Static task
static1
Behavioral task
behavioral1
Sample
42cf48711c0c33d47650745f6a184ee02466865579828ca80aed62d112ce6971.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
42cf48711c0c33d47650745f6a184ee02466865579828ca80aed62d112ce6971.exe
Resource
win10v2004-20240611-en
General
-
Target
42cf48711c0c33d47650745f6a184ee02466865579828ca80aed62d112ce6971
-
Size
2.7MB
-
MD5
f291f9fb6514653350621dfeb9c454da
-
SHA1
a83ba85d7db81a2359405fe49eb076e4aa28581b
-
SHA256
42cf48711c0c33d47650745f6a184ee02466865579828ca80aed62d112ce6971
-
SHA512
1383f263f6314b2ee5c4e50d90a51463b6086f1797d7ba20e3c728550076484fb66eb582b575a21ffbc09b169eda8f0731d7e91d44e4b1ff3c4648e9b3ac0413
-
SSDEEP
49152:9fyT+P66XbOP/ZzA2DItg1Hoaz6wecYfFkURwlhyAuLjf/IVgs1+xP:0TE66yXZ02DwUHoazRofxIhELjf/IVgs
Malware Config
Signatures
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42cf48711c0c33d47650745f6a184ee02466865579828ca80aed62d112ce6971
Files
-
42cf48711c0c33d47650745f6a184ee02466865579828ca80aed62d112ce6971.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ