Behavioral task
behavioral1
Sample
df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2.exe
Resource
win10v2004-20240802-en
General
-
Target
df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2.zip
-
Size
7KB
-
MD5
a77f56bdf12ed4edcb576934d931a308
-
SHA1
8d09f537291c647d29821248bda41f43cb8f5da0
-
SHA256
24e83878304744562f8426b7b444026c03b0941807c0ad35993ff9f75ce85811
-
SHA512
8718f9cf42e7593833b124798e95114bc8dec8c478662f83c1de1248b29485bdc522a51e24e09df0eaa62644345b0145c28c7128ea7712676367633a6213f797
-
SSDEEP
192:X5G649SPMr0vCSpqZ0HYA4lCEVJrdkgcRAlEqv7EDb/+gvq:JGp9CMOCSpqSH4lZzrdkqlE/+Yq
Malware Config
Extracted
systembc
94.232.46.202:4321
192.168.1.28:4321
Signatures
-
Systembc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2
Files
-
df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2.zip.zip
Password: infected
-
df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2.exe windows:4 windows x86 arch:x86
3a0233c129f2514486a242d7d5874037
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassA
ShowWindow
TranslateMessage
UpdateWindow
wsprintfA
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
kernel32
WaitForSingleObject
WriteFile
SetFilePointer
VirtualFree
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
CreateThread
ExitProcess
FileTimeToSystemTime
GetCommandLineA
GetCurrentProcess
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
SetEvent
VirtualAlloc
Sleep
SystemTimeToFileTime
advapi32
RegOpenKeyExA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegSetValueExA
GetSidSubAuthority
RegDeleteValueA
RegCreateKeyExA
wsock32
closesocket
connect
inet_addr
inet_ntoa
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
htons
WSAStartup
ws2_32
freeaddrinfo
WSAIoctl
getaddrinfo
ole32
CoUninitialize
CoInitialize
CoCreateInstance
secur32
GetUserNameExA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExW
QueryContextAttributesA
InitializeSecurityContextA
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 370B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ