Behavioral task
behavioral1
Sample
c8b896859a253598d068c48182eb581bcfecd73f64ab93ec58d055bea41310a0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c8b896859a253598d068c48182eb581bcfecd73f64ab93ec58d055bea41310a0.exe
Resource
win10v2004-20220901-en
General
-
Target
c8b896859a253598d068c48182eb581bcfecd73f64ab93ec58d055bea41310a0
-
Size
119KB
-
MD5
69af28f57e294702a7f6981ed3ad22b6
-
SHA1
6c1335206b88c1f9da7ba7bf30a8e473e7726797
-
SHA256
c8b896859a253598d068c48182eb581bcfecd73f64ab93ec58d055bea41310a0
-
SHA512
c2755c1f195fc5c0e9ca9b64bacf484fbf83c1ac94720e8d2381cd28c5ce7a527cefacdf5f5405a8b1caa45c46139bfd67608d4451ab9fb1cc168913b90a687f
-
SSDEEP
3072:En2UpspFKUDoVDnaN80MAQTwjluWZxh1cK/QJMA:6qpFD2aNCTPWZxh1P/7A
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
c8b896859a253598d068c48182eb581bcfecd73f64ab93ec58d055bea41310a0.exe windows x86
74d49dbdf79fffb86c888b081d4770e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
kernel32
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameW
LocalAlloc
SetLastError
GlobalFree
GetLastError
LocalFree
GetCommandLineW
GetTickCount
msvcrt
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_wcsicmp
crypt32
CryptStringToBinaryW
CertFreeCertificateContext
efsadu
EfsUIUtilEnrollEfsCertificate
EfsUIUtilInstallDra
EfsUIUtilShowBalloonAndWait
EfsUIUtilSelectCard
EfsUIUtilpKeyBackup
EfsUIUtilPromptForPin
EfsUIUtilEncryptMyDocuments
ntdll
RtlAllocateHeap
RtlImageNtHeader
RtlFreeHeap
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE