Overview
overview
7Static
static
3Email Soft....9.rar
windows7-x64
3Email Soft....9.rar
windows10-2004-x64
3Email Soft...ns.txt
windows7-x64
1Email Soft...ns.txt
windows10-2004-x64
1Email Soft...gs.txt
windows7-x64
1Email Soft...gs.txt
windows10-2004-x64
1Email Soft...rs.txt
windows7-x64
1Email Soft...rs.txt
windows10-2004-x64
1Email Soft...ase.db
windows7-x64
3Email Soft...ase.db
windows10-2004-x64
3Email Soft...ix.exe
windows7-x64
1Email Soft...ix.exe
windows10-2004-x64
7Static task
static1
Behavioral task
behavioral1
Sample
Email Software 1.4.0.9.rar
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Email Software 1.4.0.9.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Email Software 1.4.0.9/Config/FakeDomains.txt
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Email Software 1.4.0.9/Config/FakeDomains.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Email Software 1.4.0.9/Config/SearchServerSettings.txt
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Email Software 1.4.0.9/Config/SearchServerSettings.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Email Software 1.4.0.9/Config/UserFolders.txt
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
Email Software 1.4.0.9/Config/UserFolders.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Email Software 1.4.0.9/Config/serverdatabase.db
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
Email Software 1.4.0.9/Config/serverdatabase.db
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Email Software 1.4.0.9/fix.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
Email Software 1.4.0.9/fix.exe
Resource
win10v2004-20240802-en
General
-
Target
Email Software 1.4.0.9.rar
-
Size
158.8MB
-
MD5
17ab89ccbd3e360b0e3ff65032f2c473
-
SHA1
97db20f56b49b2d15fb837b2c56da259e7934220
-
SHA256
3bb96f52608f37ed2fe90ef35111ffea70fd34a3ab85e19f43c948cf47d86671
-
SHA512
72a3253723ff0ceebcaf3f6a98acccd84c22dbc75ea754b77ece86edc6581f446baababee68881adfde5495999cd7603b4b6ed92d065cc31a4a138fc8c5a790f
-
SSDEEP
3145728:2lLItkBvX6K4EUPEgHeLAC+0Gtc2+9VDD96IcQ8PAVMpjjNRnZ:2likBZ4rcgHeL4L22igACJNf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Email Software 1.4.0.9/fix.exe
Files
-
Email Software 1.4.0.9.rar.rar
-
Email Software 1.4.0.9/Config/FakeDomains.txt
-
Email Software 1.4.0.9/Config/SearchServerSettings.txt
-
Email Software 1.4.0.9/Config/UserFolders.txt
-
Email Software 1.4.0.9/Config/serverdatabase.db
-
Email Software 1.4.0.9/fix.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.enigma1 Size: 22.9MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 624KB - Virtual size: 624KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE