Static task
static1
Behavioral task
behavioral1
Sample
ishredder-windows.msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ishredder-windows.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
(x32bit.)_v7.0.21.01.09_patch.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
(x32bit.)_v7.0.21.01.09_patch.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
(x64bit.)_v7.0.21.01.09_patch.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
(x64bit.)_v7.0.21.01.09_patch.exe
Resource
win10v2004-20240802-en
General
-
Target
119712b6c7d01cdbc28970b08d49961bd3ca6c60a799137e41ecb07d02148f1a
-
Size
5.8MB
-
MD5
b213d28097652ff8ee1fad276fcd2127
-
SHA1
3de4b4aee53a549c857e60a969b2fdc1a8a9261f
-
SHA256
119712b6c7d01cdbc28970b08d49961bd3ca6c60a799137e41ecb07d02148f1a
-
SHA512
aca3d6e7c5b930f09dd38692bf19731d6b373ede54d189aade5d304a4875c5228a242346dc1562d022284c4f4a161b94e52f3e13c80904787a1d0cac0aaf35df
-
SSDEEP
98304:mWpS9L96Wo8FJ6zCohZ27WmwSWoK3qJAF3vL1AyytIRGkGqwlCwnScBKGGVB:mWpS9B6ucGo32d5dK3qJGvby0GkGqwne
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/(x32bit.)_v7.0.21.01.09_patch.exe unpack002/(x64bit.)_v7.0.21.01.09_patch.exe
Files
-
119712b6c7d01cdbc28970b08d49961bd3ca6c60a799137e41ecb07d02148f1a.zip
-
ishredder-windows.msi.msi
-
patch-MrSzzS.rar.rar
-
(x32bit.)_v7.0.21.01.09_patch.exe.exe windows:5 windows x86 arch:x86
dc73a9bd8de0fd640549c85ac4089b87
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
Sections
.text Size: 512B - Virtual size: 502B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 866KB - Virtual size: 865KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 82B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
(x64bit.)_v7.0.21.01.09_patch.exe.exe windows:5 windows x86 arch:x86
dc73a9bd8de0fd640549c85ac4089b87
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile
Sections
.text Size: 512B - Virtual size: 502B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 850KB - Virtual size: 849KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 82B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
read me.txt