Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/12/2024, 01:07
241213-bgqraavphp 10Static task
static1
Behavioral task
behavioral1
Sample
INV01542 , INV01562-7500003124 JTR-0084.exe
Resource
win7-20240708-en
General
-
Target
32242204396fc8f3e2b6a6731533b72b.bin
-
Size
706KB
-
MD5
46baad46a31ebdb338962b1356a1b40a
-
SHA1
66fbdb086e12b4eda6d9793a6c790f3e50d5a77f
-
SHA256
41e668c7afd9fffff257e17583e10f636eb4f2a1a54ae9d8bfbc1869d18a56ed
-
SHA512
5f4d67e049d70d4f0c660d655d6c5775856ead61602232916d76023854eaad168f3858edc2eaace5dc469f060d2eafb7702e137f44f68f3c2caacc06b468fc93
-
SSDEEP
12288:RGzpX2hWrBy+m2lrtWmiEz4GjEIaspcBDGUiJ2llaFbRa/bUIzSqWf5:MzpjQ4cC4MyRBDGUi4/aFbRa/Yp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/INV01542 , INV01562-7500003124 JTR-0084.bat
Files
-
32242204396fc8f3e2b6a6731533b72b.bin.zip
Password: infected
-
c4818f6a9908f61464ed5c1187f893a8b0a782683db27d0c15f9da93c872bbff.7z.7z
Password: infected
-
INV01542 , INV01562-7500003124 JTR-0084.bat.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 814KB - Virtual size: 814KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ