Static task
static1
Behavioral task
behavioral1
Sample
Chapter 8/sample_packed.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Chapter 8/sample_packed.exe
Resource
win10v2004-20241007-en
General
-
Target
Chapter 8.zip
-
Size
312KB
-
MD5
261784a427e94612e38c146938153f75
-
SHA1
8c015378d0b4febaa06dff81b319a7691947938f
-
SHA256
917de900fa94c6702d1b63f7b095fab5dcd46217b9bb424fe9951706a7f89141
-
SHA512
ba1fdf889ac8f4c38efaeb02f5535d490d9d09b10ab95845a5236b6ca96f6188fce4f38f4d9f7b29d43a8a4b9c29b1e3bf4cbb5d675323b263b2671e75eadb9e
-
SSDEEP
6144:6e/qI9gZwZUAJb94nOluKxFew580UEcqckg7qtjRpyn1ALrIx4m0M1o:66P9gi9GOluKLJ8acROtjRpggYP0MC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Chapter 8/sample_packed.exe
Files
-
Chapter 8.zip.zip
Password: infected
-
Chapter 8/.DS_Store
-
Chapter 8/emotet.txt
-
Chapter 8/sample_packed.exe.exe windows:4 windows x86 arch:x86
Password: infected
4530a8f7af9ac0c1b8ba720b1860a723
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
GetDC
gdi32
Arc
comdlg32
PrintDlgW
advapi32
FreeSid
shell32
DragFinish
ole32
OleRun
shlwapi
StrChrIA
comctl32
ImageList_Add
Sections
.MPRESS1 Size: 295KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE