Behavioral task
behavioral1
Sample
ef5690d8d8953a697a49a1a620d638718a612f6678db420ec998e3a2d40c4386.exe
Resource
win7-20240729-en
General
-
Target
ef5690d8d8953a697a49a1a620d638718a612f6678db420ec998e3a2d40c4386
-
Size
4.3MB
-
MD5
d264bd91aa92ac22643122c31cd3e97d
-
SHA1
b9f768ee73cc44b77ff2895a3fc08c887cec9bdc
-
SHA256
ef5690d8d8953a697a49a1a620d638718a612f6678db420ec998e3a2d40c4386
-
SHA512
4d3dc7b2407cb2a91a2ab9a39b1c3891b6a0a3bb7700eba25b4b311536dcd8ff146e7c8c77e3c33f52c0d7ef1ce74247bb61b0101055fa7d1d3ab605fafd8b6a
-
SSDEEP
98304:PLTRacrSabaFtpzZBVVWpUpuaUR8OaYoJ3Vs+JH1:PLTRacrSaba/Rjv28W8OCssH1
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242
Files
-
ef5690d8d8953a697a49a1a620d638718a612f6678db420ec998e3a2d40c4386.exe windows:4 windows x86 arch:x86
Code Sign
33:4a:e8:f8:de:e6:75:55:b1:59:68:29:5a:72:23:b9Certificate
IssuerCN=QiShi(Shenzhen) Company Limited,ST=Hubei,C=China,1.2.840.113549.1.9.1=#0c103736333739373232334071712e636f6dNot Before24/12/2021, 11:19Not After24/12/2040, 16:00SubjectCN=QiShi(Shenzhen) Company Limited,ST=Hubei,C=China,1.2.840.113549.1.9.1=#0c103736333739373232334071712e636f6dc9:5e:d1:34:70:bb:9a:78:e9:44:51:1c:c2:b5:64:de:c2:ce:33:38Signer
Actual PE Digestc9:5e:d1:34:70:bb:9a:78:e9:44:51:1c:c2:b5:64:de:c2:ce:33:38Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 593KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 421KB - Virtual size: 892KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 433KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE