Static task
static1
Behavioral task
behavioral1
Sample
583143_ru400.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
583143_ru400.exe
Resource
win10v2004-20240709-en
General
-
Target
583143_ru400.exe
-
Size
18.4MB
-
MD5
244bb327dab1cda112ac298a666f1a87
-
SHA1
0cabf79ea9fdef6ded3ff7af1444045fe905a056
-
SHA256
f9802f8df9670ac78e9453a836b924b212ac081d67183f50fdcf3c7e9c949b9e
-
SHA512
13fcd65f15a52130cf21525b10437b4ab4157346d2999476797db9b5b54b686f50edac9e624b48af365f79644a66492461ddc44fcb74cf2f5ab4aeb16818f774
-
SSDEEP
393216:CgcJ4RUzCjd4PwgNahd2PnYEMdLYG6WNMMQ8QzHCplx8JgmvMZ8XT4N:kJ4MWfg8DInCYGl5QXbYP8Jgm/Xk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 583143_ru400.exe
Files
-
583143_ru400.exe.exe windows:6 windows x64 arch:x64
Password: EOEnvy
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.d7qm Size: 10.8MB - Virtual size: 10.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.iwk Size: 512B - Virtual size: 368B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ebubm Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 445B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ