Static task
static1
Behavioral task
behavioral1
Sample
Nursultan Alpha (prem).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Nursultan Alpha (prem).exe
Resource
win10v2004-20250217-en
General
-
Target
NursultanAlphapreminfected.zip
-
Size
3.5MB
-
MD5
53d811efc8531b13c911b89f2ef87551
-
SHA1
0a07836e8ea3dda7ac868a22b320c3652bd0e4a1
-
SHA256
c97add81fe634aac6a0291ebbefc67bc3748966e27cca7fec62e54a54a50abc8
-
SHA512
63a710b2c9adeec2e66c2fbf39dd4469e2336e293657b7108cf9a4f58abb6cad7a6171cf682b1259e0d92e807bef7876abaf36a2567c2d5dfb807250687cb107
-
SSDEEP
98304:Eepl3bD1E2SSRWiKhMtAMyTAo6+QYlQw0O8zzZQwO6YT:Ekl3bBE2W338o6p6QdO8zzZy/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nursultan Alpha (prem).exe
Files
-
NursultanAlphapreminfected.zip.zip
Password: infected
-
Nursultan Alpha (prem).exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ