Static task
static1
General
-
Target
1f172321dfc7445019313cbed4d5f3718a6c0638f2f310918665754a9e117733
-
Size
220KB
-
MD5
f25e25832dad770c5f989c986770f9e6
-
SHA1
2565983f765b76a183de4b6ee793b4903e40c505
-
SHA256
1f172321dfc7445019313cbed4d5f3718a6c0638f2f310918665754a9e117733
-
SHA512
ceb56a676e28ca413b1bbebb4039a9d4330a4eaf1a6985e5e61fc8cb3052823bedbd6cfbb24dce8f07cb1dafdc94a968847e43c74582dd3b3d26e7c8f8f7eab2
-
SSDEEP
6144:kX9tCEaWu2CqlZlMLq9a2m8MblSkw8k5Pp/OuADofm02gzsN9YPJ:kttkWM5Sa2m8MTwT5BGw/zsNOP
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx
Files
-
1f172321dfc7445019313cbed4d5f3718a6c0638f2f310918665754a9e117733.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
abcd Size: - Virtual size: 272KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ebdf Size: 218KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE