wetransfer_ericx-sef_2024-09-07_1850.zip
- SHA256 2b46246b77cc81208f045b0ec933f889c273e1c0d3d0af4ba94bd9c821bdde47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ericx sef/toolbot.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ericx sef/toolbot.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target wetransfer_ericx-sef_2024-09-07_1850.zip
- Size 82.5MB
- Sample240907-246n5ashpd
- SHA256 2b46246b77cc81208f045b0ec933f889c273e1c0d3d0af4ba94bd9c821bdde47
- MD5 bcd086783ac39d959ed3e538836b35c4
- SHA1 f6eaaa707c3d97eccf46424029934a71b0f957c0
- SHA512 8939612672733c0d659725176946d745359c962ae296e872254cee2be899a33e193faeb0c38d6e0ad97053c42e09ce2a25a7163719e51850632938c003076da1
- SSDEEP 1572864:iEnUSsE/ehnUtzYSU3lyhIiWHWkUHmjQtbCmBbOnSR13pyAAXyDuz4H10YAY:uSsE/ehUtUrNWkk5gqbT5yANuz4VZAY
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ericx sef/toolbot.exe
File Explorer
-
wetransfer_ericx-sef_2024-09-07_1850.zip.zip 82.5MB
-
ericx sef/toolbot.exe.exe 82.5MB
ericx sef/toolbot.exe
- IMPHASH a5a14e43a0485d520c4b3635b8afc414
- SHA256 770051640cb59d368e625c0b1d6b1e66ec93454e3185902ee2d66f1253617503
- MD5 a3439271f6de235c7d368d3c698ada9b
- SHA1 5ce0b86e04d5957501399234b56efc102c737a31
- SHA512 2b992add3c53d7860d9fc536f926d4322b8802c8989fa37a2ba20bc9cfa6c6a6ba305f92f8f55d557b3fc60329eefbc9bd8f401fe9b99f3ddd465b2de20bb925
- SSDEEP 1572864:/EnUSsE/ehnUtzYSU3lyhIiWHWkUHmjQtbCmBbOnSR13pyAAXyDuz4H10YA:fSsE/ehUtUrNWkk5gqbT5yANuz4VZA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
48500
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shell32
SHFileOperationW
SHGetFolderPathW
kernel32
WriteConsoleW
CreateDirectoryW
SizeofResource
SetConsoleCtrlHandler
GetCommandLineW
GetStdHandle
WriteFile
TerminateProcess
GetModuleFileNameW
SetEnvironmentVariableW
GetTempPathW
FindResourceA
WaitForSingleObject
CreateFileW
GetFileAttributesW
Sleep
GetLastError
LockResource
CloseHandle
LoadResource
GetProcAddress
GetCurrentProcessId
CreateProcessW
WideCharToMultiByte
GetSystemTimeAsFileTime
FormatMessageA
GetExitCodeProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
HeapReAlloc
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapAlloc
MultiByteToWideChar
HeapFree
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
Name
.text
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
82.4MB
Virtual Size
82.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=260, version=27412,
count=6, id=259, version=27412,
count=142, id=261, version=27412,
count=2, id=253, version=28518,
count=37, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=5, id=257, version=27412,
count=109, id=1, productName=Unmarked objects,
count=1, id=265, version=30154,
count=1, id=258, version=30154,