Behavioral task
behavioral1
Sample
iexplore.exe_0x13140000-0xa58000.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
iexplore.exe_0x13140000-0xa58000.exe
Resource
win10v2004-20240704-en
General
-
Target
iexplore.exe_0x13140000-0xa58000.exe
-
Size
10.3MB
-
MD5
12954ea4a02a8fa57491d5528b851310
-
SHA1
0c26bfbda3c26847a1ab86dfd663260bc7a08470
-
SHA256
9eae6ab43cb2293055c5a36ac07c7a090fa9bdcc609ba7e3b5355d16348f1c00
-
SHA512
315f24082f06a6cfb14a3f136fd4c1496f7eac9d772af441bc723bf90298bc2edafb6955e3da35db4a3261283a7a3735eb1477c820fb28adba71c7e95bc33997
-
SSDEEP
3072:Qp05ARM4WXkydwwelMci2VOwoHD65c/bwMo6Iy:QOv4WowZ/bo
Malware Config
Signatures
-
Bandook family
-
Bandook payload 1 IoCs
resource yara_rule sample family_bandook -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource iexplore.exe_0x13140000-0xa58000.exe
Files
-
iexplore.exe_0x13140000-0xa58000.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 10.3MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 37KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE