Behavioral task
behavioral1
Sample
f6628ddf3f464b6aa56ad21264762031a78462cf7ba29ed2a2c4920cec46e469.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f6628ddf3f464b6aa56ad21264762031a78462cf7ba29ed2a2c4920cec46e469.exe
Resource
win10v2004-20240802-en
General
-
Target
57c5e103f0f1b891c3e3c0e1b1757408.bin
-
Size
249KB
-
MD5
0f5a57efea229566e3f987338ca69ef4
-
SHA1
39ab678dbe8e0f99b80b65e056f3901f691d3b16
-
SHA256
fc4020b22b0f2850e76b80e302a53a6e8ed78476db008bae20aa4c3891bbb8e7
-
SHA512
0576fd0b2be03313c142a73ce62f0520df71b91eb235a21e53c09e30a54c0de5fb539baf249a7bcdf16c7fb39a241a16bc205b74943437eeac83bba69778555c
-
SSDEEP
6144:tRKhVV2ZpvNrW6M3Rv7R+iMg6U/ErXyUPQShuvPSvZf5kp5PE4w6T:ezV2PNIZ9+3g6zyUvoSvZxUx1
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/f6628ddf3f464b6aa56ad21264762031a78462cf7ba29ed2a2c4920cec46e469.exe
Files
-
57c5e103f0f1b891c3e3c0e1b1757408.bin.zip
Password: infected
-
f6628ddf3f464b6aa56ad21264762031a78462cf7ba29ed2a2c4920cec46e469.exe.exe windows:5 windows x86 arch:x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 348KB - Virtual size: 348KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ