Static task
static1
Behavioral task
behavioral1
Sample
RFQ 412.24 10.09.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RFQ 412.24 10.09.exe
Resource
win10v2004-20240802-en
General
-
Target
RFQ 412.24 10.09.tar.gz.exe
-
Size
1.8MB
-
MD5
ed8b3713eb5e99e89d8c25e0cf1a1c9c
-
SHA1
65e561f5f32665f0e7f997bf6eda25ba4e614e5f
-
SHA256
e29e2c1019428f23f92327c4608c6aa8038b39889432be5bb0c7ce96ba63bacb
-
SHA512
05a34971e42de146713dbc7944f570ba09d94fd916fb92e8482a36a64e00be943d75d253c8ab35a2f348ae18726979e7696c6207478cb8a4459f41b0e784ec5c
-
SSDEEP
24576:CBuCDJRpDyeGykCiwDbdStLd+1yvNF2q:CBDrxDGhDyF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RFQ 412.24 10.09.exe
Files
-
RFQ 412.24 10.09.tar.gz.exe.tar
-
RFQ 412.24 10.09.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ