FlightReader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
FlightReader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FlightReader.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
FlightReader.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
FlightReader.exe
Resource
win11-20240802-en
General
-
Target
79f0e728ef16dd8bbb02e85b1dac7b20defb7c23b40d89ac3279d1430ab39050.zip
-
Size
1.5MB
-
MD5
482ac4dfcc4b996b9455632f913cc016
-
SHA1
2a0517b6a677f4937643c915cb690ded359f337d
-
SHA256
cecaa0f70cdb0703ff18828658b86dbe3a94838257a78c11506d79e6d289ec3d
-
SHA512
d45ec9529b34bde0deab67bcf7e91e4cb35952bea518c84ace0232f6eceb4ad757ece4709bb60e66a8d16b45d3b5b1106f4f8aaf5fd715aa6fd3060710919a49
-
SSDEEP
24576:M33V5La6TcRlIK87JwDKufrMgDNB+4QiRSeP0zM/oeAnz5ViTqpWPpkqHvbh:+HIlr8t/ufrlJdd/U5WqpWPbP1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FlightReader.dll
Files
-
79f0e728ef16dd8bbb02e85b1dac7b20defb7c23b40d89ac3279d1430ab39050.zip.zip
Password: infected
-
FlightReader.dll.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
- H4f Size: 943KB - Virtual size: 943KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ