Static task
static1
Behavioral task
behavioral1
Sample
p.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
p.exe
Resource
win10v2004-20240802-en
General
-
Target
p.7z
-
Size
1KB
-
MD5
62e845fdd2290b83390dc22e6300ab9e
-
SHA1
cd9c973dcfd30d1dd497038121c2a4f199f39200
-
SHA256
188825246a4d60a57d249bbc604e904f70ea337834220b15d2ad7f90db9985af
-
SHA512
bd1b3c3ef27d30da84280bf3da870ab58a17bbdb116071fc0856ef6e984af808767a2afa955050083e7415815528abca38f89ef88abbc2f6e1b099c5a3a26f19
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/p.exe
Files
-
p.7z.7z
Password: infected
-
p.exe.exe windows:6 windows x64 arch:x64
6ca670a5214ee12cf502029b439a6bc5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
NtDeviceIoControlFile
NtClose
NtOpenFile
RtlInitUnicodeString
Sections
.text Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 538B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ