Behavioral task
behavioral1
Sample
7ae309004c521370228d31e2d1501092fecdb6bc00016e84cad8e6dc4cde2890.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7ae309004c521370228d31e2d1501092fecdb6bc00016e84cad8e6dc4cde2890.exe
Resource
win10v2004-20220901-en
General
-
Target
7ae309004c521370228d31e2d1501092fecdb6bc00016e84cad8e6dc4cde2890
-
Size
122KB
-
MD5
027f5fe8de8c8ef769d17036a455a361
-
SHA1
d7235f675c05af056251fdfd29945c275f08da2a
-
SHA256
7ae309004c521370228d31e2d1501092fecdb6bc00016e84cad8e6dc4cde2890
-
SHA512
18d2070ce67ae546b1dc91b4f2b1ded109f57e1dea3e19316fef7068d5a3ab58b6459969dea96063c17976616baa1b7fe6fd3bc022aeebc17473e6cc30f15b95
-
SSDEEP
3072:MJ519qm5TU9UnFshFZKnOs9vLfhZRTxMJUbihLE:MJL9qmOCFshFIHxFZu1E
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
7ae309004c521370228d31e2d1501092fecdb6bc00016e84cad8e6dc4cde2890.exe windows x86
e49dda365a8e4d5edb19890d54816256
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_itoa
_mbsupr
strncpy
_mbsicmp
getchar
_except_handler3
wcslen
_initterm
__setusermatherr
_adjust_fdiv
exit
__p__fmode
__set_app_type
_controlfp
_c_exit
_exit
_XcptFilter
_cexit
__initenv
wcschr
wcscat
_iob
fputs
_getch
putchar
_strupr
__p__commode
__getmainargs
strchr
strstr
_mbslen
kernel32
LoadLibraryW
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
SetThreadUILanguage
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FormatMessageA
CreateEventA
LocalAlloc
LocalFree
WaitForSingleObject
SetEvent
lstrlenA
ExpandEnvironmentStringsA
OpenFile
SetConsoleCtrlHandler
GetModuleHandleA
MultiByteToWideChar
lstrlenW
Sleep
GlobalFree
GetLastError
GlobalAlloc
rasapi32
RasGetConnectStatusA
RasGetErrorStringA
DwRasUninitialize
RasGetEntryPropertiesA
RasGetEapUserIdentityA
RasDialA
RasFreeEapUserIdentityA
RasHangUpA
RasEnumConnectionsA
user32
CharToOemA
LoadStringA
LoadStringW
CharToOemW
crypt32
CryptUnprotectMemory
CryptProtectMemory
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE