Static task
static1
Behavioral task
behavioral1
Sample
8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
.dll
Resource
win10v2004-20241007-en
General
-
Target
8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4
-
Size
6.3MB
-
MD5
b43c9bd4a44f5b1ea78b2e77e97dc16a
-
SHA1
3d5e32b4b26d404337d2ae3276029fc069159e67
-
SHA256
8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4
-
SHA512
ffe0b988646e39b61bf0a8244dc00eb666a631f390c2f9195c731ffcb39314283e3ddbeb1ff678d09b14bfa5a4703576e150de3e2437edc57bcd3d1dd53ef96d
-
SSDEEP
49152:oBOZB05ydBveP6LYo4/iB8nQTIDMsLMmPQyIxiyFioTd3NCWpG4Vpw:6SMMBveMYb/iE3MmPx0TddCC
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4 unpack001/.enigma2
Files
-
8a2318758171d7ed4d6f1732bf8606fb7c14049b15128babf55dd61e9b7422e4.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.enigma1 Size: 120KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 280KB - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
.enigma1
-
.enigma2.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 208KB - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 79B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
.reloc
-
.rsrc/0/GROUP_ICON/FLAMEIA-XRABBIT-TOOLS-INSTALLER
-
.rsrc/0/ICON/1.ico
-
.rsrc/0/ICON/2.ico
-
.rsrc/0/ICON/3.ico
-
.rsrc/0/ICON/4.ico
-
.rsrc/0/ICON/5.ico
-
.rsrc/0/ICON/6.ico
-
.rsrc/0/ICON/7.ico
-
.rsrc/1033/MANIFEST/1.xml
-
.rsrc/1033/version.txt
-
.text