Behavioral task
behavioral1
Sample
WinFontsView.exe
Resource
win7-20240903-en
General
-
Target
WinFontsView.rar
-
Size
41KB
-
MD5
db0ff5e44cdd7d718fc85bdc2c5ac957
-
SHA1
315570d42ad73a9954b3a033d849dd3598527924
-
SHA256
1d6f69d6a41aa0b52728cd3e6855e20d17cad83a3d5c2a456ca438c9716ac9e5
-
SHA512
23936d6ae02f87b4ca4567c9d746c1cf85161d1b2960d58befccfa0b9644a702f27607309955b9eb992b028912dcb128ae58c091e7522790616ed28c3694988e
-
SSDEEP
768:nWJPZi5yyF+OCDOCqjcD6yuY5zpKNBeWVEHBIQcMKttAWaz+FPI+2SZIOvEev:WPTOCDfqQAQzUhL8WazEHsc
Malware Config
Signatures
-
resource yara_rule static1/unpack001/WinFontsView.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/WinFontsView.exe
Files
-
WinFontsView.rar.rar
-
WinFontsView.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ih�u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE