Static task
static1
Behavioral task
behavioral1
Sample
Eternity.exe
Resource
win7-20240708-en
General
-
Target
Eternity.exe
-
Size
42.7MB
-
MD5
a761290f6e1f1b0391cd6ddf9e807bbe
-
SHA1
95f2e7d58e779d851cb8fab792941632d0e90a65
-
SHA256
72643f60a0384976c2a0477e4123588841b2cfb621ee267d02be7caca2afdc7c
-
SHA512
9f929c72e9b1f15c4eb18bc5e290c9cbce394d5c28824dd4e5e9148de86b5f9b55be325fde626ef10c6918cc12c2891c83f845b4cc9c0000798d88eb1f44b046
-
SSDEEP
786432:y/7vOXS6Dz9ni63RV1fs0atgSIK1qH9htK56Z9otVys1GNq9Xulv/aH:y/7OvDsUr1fs0aWSIKsVVDoTysgNq9e8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Eternity.exe
Files
-
Eternity.exe.exe windows:6 windows x64 arch:x64
23d1fa35b6f0b9d0eb6c9c223189c529
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
normaliz
IdnToAscii
ws2_32
ntohl
wldap32
ord46
crypt32
CryptQueryObject
advapi32
CryptAcquireContextA
kernel32
VerifyVersionInfoA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
shell32
ShellExecuteA
msvcp140
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
urlmon
URLDownloadToFileA
ntdll
RtlLookupFunctionEntry
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
fputs
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64
Sections
.text Size: - Virtual size: 480KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xorstr1 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xorstr0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vlizer Size: - Virtual size: 13.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xorstr2 Size: - Virtual size: 22.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xorstr3 Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xorstr4 Size: 42.6MB - Virtual size: 42.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ