vfocc4[.]7z | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vfocc4.7z
Size

1.1MB
MD5

f870b049fbc3c9e7360f18f402a1008d
SHA1

a535f105f06cc49ca56fa3d415ecf6030abf9887
SHA256

d4e8524e7f91b441fc0a4d0440948c88225b87a240797b51e582ef98e439c285
SHA512

52c34d44bdb86d9dc8214a1eb80419d3c26599f7707c8b28de471a89ef31f3e0e6319b9ea21f24e840a415825121202d848ea4093ac90a8cbdf61bf5eaebf9c9
SSDEEP

24576:I4C9N775c2sF6TZhLJ63F8GdVwunss2cZMFb1KAB87U5u1:M775LsgLajdVwuzPZCIABkUw1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/justasigma_unpacked.exe

Files

vfocc4.7z
.7z

Password: infected
justasigma_unpacked.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 974KB - Virtual size: 974KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 417KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ