Static task
static1
Behavioral task
behavioral1
Sample
23-59 Electricas BC Corp PO EDC0969388.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
23-59 Electricas BC Corp PO EDC0969388.exe
Resource
win10v2004-20241007-en
General
-
Target
17102024_1352_17102024_23-59 Electricas BC Corp PO EDC0969388.img
-
Size
70KB
-
MD5
aaa3d7618ffe11250d71a6370ffa1e50
-
SHA1
da5518b649078b3974bc90631ab6357ae63fff8c
-
SHA256
f8477f87e5c700a42344aa752a3abcf73cfcce927c45532d96e27d25ad8d4f71
-
SHA512
f07865a9a7a9e9e7a73c3a7b58d95ff752955a0043bad9bc50745577de23e25a6bf93fc700d493e12c68e37d34745229e2bb642497b004db85b1def7cfd7b6a4
-
SSDEEP
192:At+OvxwtHj0Xu//BjQl1wfDyNoaWap34RTTFTWPFYHN5JKl0M0C/0A0E:WNIHUkBjY18yNonap3OTFTOrv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/23-59 Electricas BC Corp PO EDC0969388.pif
Files
-
17102024_1352_17102024_23-59 Electricas BC Corp PO EDC0969388.img.iso
Password: infected
-
out.iso.iso
Password: infected
-
23-59 Electricas BC Corp PO EDC0969388.pif.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ