Behavioral task
behavioral1
Sample
89c22c8da553df69afee19666159933a14b16f2ebbe37922a6124762473150c2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
89c22c8da553df69afee19666159933a14b16f2ebbe37922a6124762473150c2.exe
Resource
win10v2004-20220812-en
General
-
Target
89c22c8da553df69afee19666159933a14b16f2ebbe37922a6124762473150c2
-
Size
258KB
-
MD5
2af669dca4ad5e1bb47a7be583ab4d7e
-
SHA1
ec2d9c27c047afc3f9e7cffd5b27a017226587d1
-
SHA256
89c22c8da553df69afee19666159933a14b16f2ebbe37922a6124762473150c2
-
SHA512
b4a067e7bf1e3400f421ac9a3434e5ea4cbbd67c52f2d99f149af9f626b0550b8349514a33f18b280208f9d0f659f127399dbe6e4ba6c95f2fc813889cdbd79a
-
SSDEEP
6144:DAZjhKOftnMxuemFT+M+fHFsBu5tiJ1cZaoO5yFB0kOrFpfWx:igmtnM+l+bdbtiJ1cDO5G0rWx
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
89c22c8da553df69afee19666159933a14b16f2ebbe37922a6124762473150c2.exe windows x86
adbb1fa61b9098e1109d70c4ea1c5f07
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
Sleep
GetFileAttributesW
GetVersion
GetLogicalDriveStringsW
FindResourceW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
lstrcpynA
lstrlenA
GetLastError
GetFullPathNameA
GetFileAttributesA
lstrcpynW
lstrlenW
GetModuleHandleW
LoadLibraryW
FreeLibrary
GetCurrentProcess
MultiByteToWideChar
GetCurrentThread
GetTickCount
CreateDirectoryW
SystemTimeToFileTime
GetThreadPriority
GetSystemTime
InitializeCriticalSection
BeginUpdateResourceW
GetProcAddress
LoadLibraryA
user32
SetTimer
advapi32
AllocateAndInitializeSid
RegEnumKeyExW
RegDeleteValueW
RegEnumKeyW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RevertToSelf
OpenProcessToken
FreeSid
EqualSid
GetTokenInformation
RegDeleteKeyW
RegDeleteKeyA
SetThreadToken
DuplicateToken
OpenThreadToken
shell32
SHGetDesktopFolder
mssip32
CryptSIPVerifyIndirectData
CryptSIPCreateIndirectData
ncobjapi
WmiDestroyObject
Sections
.text Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 2KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX1 Size: 82KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 4KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 140KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ