Behavioral task
behavioral1
Sample
24426c118262fa556d62cb06c53cd67a5cf2290e7ebfb1d36236e92a7030a0ce.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
24426c118262fa556d62cb06c53cd67a5cf2290e7ebfb1d36236e92a7030a0ce.exe
Resource
win10v2004-20221111-en
General
-
Target
24426c118262fa556d62cb06c53cd67a5cf2290e7ebfb1d36236e92a7030a0ce
-
Size
310KB
-
MD5
1fcafd4e0f7c87f1f3dee641b9fe04a4
-
SHA1
807e3a7d75d6e842da116b502852ccd44b921eb7
-
SHA256
24426c118262fa556d62cb06c53cd67a5cf2290e7ebfb1d36236e92a7030a0ce
-
SHA512
6a190aabc93204943d17ebda85b8101e448a31c86e3b69267af09c28b5db34ed73a31f3bab8accf534b1f71224f4d7f6c6fc5c23c7eb288f938dd29ed0cbc8b2
-
SSDEEP
6144:dnmfJ8lRFdVodAj4dSN7XTO0QVRdAEwgUp/9u70HDSzhc:dYQXadWN7XKRdAEwgUp/22D8
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule static1/unpack001/out.upx Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule static1/unpack001/out.upx MailPassView -
resource yara_rule sample upx
Files
-
24426c118262fa556d62cb06c53cd67a5cf2290e7ebfb1d36236e92a7030a0ce.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 480KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 304KB - Virtual size: 308KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 564KB - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ