Static task
static1
Behavioral task
behavioral1
Sample
dd1816fa631cc5969fc7fa962ce89fef5a937fcb64e7abb804b57e1533781fbc.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dd1816fa631cc5969fc7fa962ce89fef5a937fcb64e7abb804b57e1533781fbc.exe
Resource
win10v2004-20240709-en
General
-
Target
505887037A74DDBF.zip
-
Size
52.9MB
-
MD5
bd1ccd4fba7970cacbe3cc6cfc13529d
-
SHA1
61d6f7b2f86d8d0a025902727054a6c7214ac76a
-
SHA256
d98b4f7e5259a7a815332c14b1d8eb4faae1b2aeb0bd95334d5eb67d4d4e34d5
-
SHA512
07eec3df7f46e8f62e857d575eac6b2d3458eaf4468ae636a91700137a983a94dd07049a33c28693f426c24979a35274ea9767656da77c5359e20970241ab06b
-
SSDEEP
1572864:x7xmB7EpYy54km6h0T4dP/qUo2t3+Gj0KhuI0:x7xm6X46dBqwAGjTa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dd1816fa631cc5969fc7fa962ce89fef5a937fcb64e7abb804b57e1533781fbc
Files
-
505887037A74DDBF.zip.zip
Password: infected
-
dd1816fa631cc5969fc7fa962ce89fef5a937fcb64e7abb804b57e1533781fbc.exe windows:6 windows x64 arch:x64
6a6af810c0ae08546080bb8e1f1f2505
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
iphlpapi
GetAdaptersAddresses
ntdll
RtlCaptureContext
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
imm32
ImmGetContext
kernel32
VirtualAllocEx
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
UnregisterClassW
advapi32
CryptDestroyHash
shell32
SHGetSpecialFolderPathW
ole32
CoCreateInstance
oleaut32
VariantInit
wintrust
WinVerifyTrust
shlwapi
PathFindFileNameA
imagehlp
SymSetOptions
bcrypt
BCryptGenRandom
xinput1_4
ord4
crypt32
CertCloseStore
ws2_32
getsockopt
Sections
.text Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text00 Size: - Virtual size: 39.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text01 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text02 Size: 54.3MB - Virtual size: 54.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ