E:\A\_work\682\s\obj\Microsoft.VisualStudio.RemoteControl\Release\net45\Microsoft.VisualStudio.RemoteControl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a348717d7eb23c235b0e9dacc38b5f4612634b9f811ffaa1c43c9c515f2729de.exe
Resource
win7-20240903-en
General
-
Target
b3ebbdbb32feadd65f0272e15d7c6d891653870515957ebf1a70a4570e5a8fe6
-
Size
538KB
-
MD5
998a023e511cfe41453a3e7dd268a8bc
-
SHA1
0063ed8218003f8f81ebdfa87dc8fd3f18af4d0e
-
SHA256
b3ebbdbb32feadd65f0272e15d7c6d891653870515957ebf1a70a4570e5a8fe6
-
SHA512
4e095b74e9539c354aa5f1694c62dc0f13143bd5ddfe412a90e8db463fdf3a9ba1522ec5d80b5179047893ced54d40fcdf0e315f32d809ff06f81b16af34a918
-
SSDEEP
12288:F3HSHBovQaVCtz4OmVwWUIBHZTt/LGXBInRsWa3Je1dIreBhE:F3HSH6vQaV9yIBHht/yxoRvyreBhE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/a348717d7eb23c235b0e9dacc38b5f4612634b9f811ffaa1c43c9c515f2729de
Files
-
b3ebbdbb32feadd65f0272e15d7c6d891653870515957ebf1a70a4570e5a8fe6.zip
Password: infected
-
a348717d7eb23c235b0e9dacc38b5f4612634b9f811ffaa1c43c9c515f2729de.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ