Static task
static1
Behavioral task
behavioral1
Sample
4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b.exe
Resource
win10v2004-20241007-en
General
-
Target
b36366f4a27987d6de47887b03f29c68.bin
-
Size
746KB
-
MD5
033dfb3f8ae89181a2e8d07028b60fe2
-
SHA1
52262037fe00c587ad69101c28610392fd3a644e
-
SHA256
b31c0f2d56beabcbd3d13284655e8c81915c8b83deb22450ff43019229f679a4
-
SHA512
31d016de08448b916e678bc0a52d02b3d0b2a39a573098c95528ca5308c93ac18f9548d8bf262667576edfdff2086f1df328a2f7da21cfe54a761c6da4bf1476
-
SSDEEP
12288:IGeSoriI5/zo9srZ7dlWldVShkMlgthXl/fz6S2KJbu00VjaR5rkgfV6GA29GPpf:JoriQMmZBlWldA9mrXl/fztxCVVjePDq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b.exe
Files
-
b36366f4a27987d6de47887b03f29c68.bin.zip
Password: infected
-
4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b.exe.exe windows:4 windows x86 arch:x86
Password: infected
3a8897c84eb41f36b4bbabcc617408b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
user32
GetWindow
advapi32
RegDeleteKeyA
shell32
SHGetFolderPathW
Sections
.text Size: 64KB - Virtual size: 440KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 772KB - Virtual size: 772KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ