Static task
static1
Behavioral task
behavioral1
Sample
shellbag anylizer.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
shellbag anylizer.exe
Resource
win10v2004-20240802-en
General
-
Target
shellbag anylizer.exe
-
Size
303KB
-
MD5
88e30898471b07ab0ac563e4bdf99764
-
SHA1
8b07516da87dc75c9860954af5f6a3a0e7e95ac3
-
SHA256
c98c7bdc88503df4eb5ef21506fc42d028f949807b959b3ff67f21964a2c0b85
-
SHA512
b06fe916f11b09b5f98469282e99f783d380481a1bb0230be32d7853675b90f3b9110c8688532d168a80a53d4d380c4c711677b05578a10476d238db812ce591
-
SSDEEP
1536:T2JYEMehJ9E1QomvlGTqGXfFHfrXEvIzVAXuiRp6EE8bMlnEfwGzod8MddBK1Ohc:avhJ9E1l0cjbpxiBYe1oUJ2hsOFlD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource shellbag anylizer.exe
Files
-
shellbag anylizer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ