Behavioral task
behavioral1
Sample
Cопроводительное письмо.docx.lnk
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Cопроводительное письмо.docx.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Doc.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Doc.exe
Resource
win10v2004-20241007-en
General
-
Target
9df6afb2afbd903289f3b4794be4768214c223a3024a90f954ae6d2bb093bea3.zip
-
Size
1.8MB
-
MD5
97733ed7f00c97ff4acc82173f56da59
-
SHA1
e76f5a871453a04293c8ecd1d6c1bc05ec582218
-
SHA256
9df6afb2afbd903289f3b4794be4768214c223a3024a90f954ae6d2bb093bea3
-
SHA512
cbe5dce5e0b73ab8735e10d67c38717ad0b6b77f6832d00a946321ce246685b82997bf9f35e6a063307d7a4b6e8fc5772fd827a34b3809b98a9d797cc5c2db69
-
SSDEEP
49152:v4QPSCiOG6tVVUzSEzmHHIHRrGgHQbST/9OuF:vxiSJUzSE4HItGRA9OuF
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Doc.zip upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Doc.zip
Files
-
9df6afb2afbd903289f3b4794be4768214c223a3024a90f954ae6d2bb093bea3.zip.zip
-
Cопроводительное письмо.docx.lnk.lnk
-
Doc.zip.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE