Behavioral task
behavioral1
Sample
df530f746f9aa0404601870a23909f813e7f3e79997fc7c249e774f481b399ff.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
df530f746f9aa0404601870a23909f813e7f3e79997fc7c249e774f481b399ff.exe
Resource
win10v2004-20240802-en
General
-
Target
df530f746f9aa0404601870a23909f813e7f3e79997fc7c249e774f481b399ff
-
Size
14.2MB
-
MD5
8daca7c3615eb3be0a8422e39ded5d4c
-
SHA1
094621f59d7039891a327c29bcb0a8e53492efc4
-
SHA256
df530f746f9aa0404601870a23909f813e7f3e79997fc7c249e774f481b399ff
-
SHA512
a252d34675a1bc73dd25437a63e414c92ac4c01d6dbe4d2f1e5c327c266316b204ac7e99f9192730435b21d9e13bc3b421607c5ca18c66a71dc2ead804179e33
-
SSDEEP
393216:5p1+TtIiHY9Z8D8Ccl6nVDNp1+TtIiHY9Z8D8Cclw5bD:5p1QtIOa8DZcsNp1QtIOa8DZcs
Malware Config
Signatures
-
Detects Pyinstaller 1 IoCs
resource yara_rule sample pyinstaller -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource df530f746f9aa0404601870a23909f813e7f3e79997fc7c249e774f481b399ff
Files
-
df530f746f9aa0404601870a23909f813e7f3e79997fc7c249e774f481b399ff.exe windows:4 windows x86 arch:x86
ed51fe4b551ae08cf25fe8d42a5793ef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
_CIcos
_adj_fptan
__vbaFreeVar
__vbaAryMove
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
_adj_fprem1
ord626
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord520
__vbaBoolVarNull
_CIsin
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaVarTstEq
__vbaPutOwner3
__vbaObjVar
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
ord716
__vbaFPException
_CIlog
__vbaFileOpen
__vbaNew2
__vbaVar2Vec
ord648
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaLateMemCall
__vbaVarDup
__vbaLateMemCallLd
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14.2MB - Virtual size: 14.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
REG_Seter.pyc