Static task
static1
Behavioral task
behavioral1
Sample
RFQ 412.24 10.09.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RFQ 412.24 10.09.exe
Resource
win10v2004-20240802-en
General
-
Target
8280999c6dfd7e79d7b98fcd1158959c.bin
-
Size
827KB
-
MD5
be04c1ee9d54e155ee15a5dfb7885632
-
SHA1
28ca3da5ab056a4771430c7992ffffc350467faa
-
SHA256
1cb4c6f25f5a95320abfd59dc8440a15422688f1fdf653ddc4e8fa4e43ea0929
-
SHA512
887368438454c40073c484287c3d7e387b4d30f165f13d16e4f1c80783aa8836cf764978a6465c9457d6ed4f07a315505590e3b678c16981b5e73ad7f3fd4a7f
-
SSDEEP
24576:+Kr5DG+d1az4I+h0k345ZDh9cPkM2lFB+at1axyzr+oEfFQtBudjqfw:28Eg+kg5/cPkpB/GxAH32
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/RFQ 412.24 10.09.exe
Files
-
8280999c6dfd7e79d7b98fcd1158959c.bin.zip
Password: infected
-
18f8405901e338292f4f15c29face7f788964a94b3422d7c2b4f3e9d50fbdaf1.gz.gz
Password: infected
-
RFQ 412.24 10.09.tar.tar
Password: infected
-
RFQ 412.24 10.09.exe.exe windows:4 windows x64 arch:x64
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ