Behavioral task
behavioral1
Sample
8980aff426c50fe5acae8c7dbedd25d6505089f2a7fb3c9643bd78a970959f4e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8980aff426c50fe5acae8c7dbedd25d6505089f2a7fb3c9643bd78a970959f4e.exe
Resource
win10v2004-20220901-en
General
-
Target
8980aff426c50fe5acae8c7dbedd25d6505089f2a7fb3c9643bd78a970959f4e
-
Size
258KB
-
MD5
5daf9a9836cb50fa54845486ecbc7306
-
SHA1
f43133adbb23261040a78adfef01717ab3819bea
-
SHA256
8980aff426c50fe5acae8c7dbedd25d6505089f2a7fb3c9643bd78a970959f4e
-
SHA512
965e2fe4ffd83d11ac2768b35e031ae56aac6e500d03db26b10005b7861282d5e990d255088cfaf3f8edcf1b980a1dd38fa4f33e52c26f52f45b6f77663bcf35
-
SSDEEP
6144:AAZjhKOftnMxuemFT+M+fHFsBu5tiJ1cZaoO5yFB0kOrFpfWx:jgmtnM+l+bdbtiJ1cDO5G0rWx
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
8980aff426c50fe5acae8c7dbedd25d6505089f2a7fb3c9643bd78a970959f4e.exe windows x86
adbb1fa61b9098e1109d70c4ea1c5f07
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
Sleep
GetFileAttributesW
GetVersion
GetLogicalDriveStringsW
FindResourceW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
lstrcpynA
lstrlenA
GetLastError
GetFullPathNameA
GetFileAttributesA
lstrcpynW
lstrlenW
GetModuleHandleW
LoadLibraryW
FreeLibrary
GetCurrentProcess
MultiByteToWideChar
GetCurrentThread
GetTickCount
CreateDirectoryW
SystemTimeToFileTime
GetThreadPriority
GetSystemTime
InitializeCriticalSection
BeginUpdateResourceW
GetProcAddress
LoadLibraryA
user32
SetTimer
advapi32
AllocateAndInitializeSid
RegEnumKeyExW
RegDeleteValueW
RegEnumKeyW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RevertToSelf
OpenProcessToken
FreeSid
EqualSid
GetTokenInformation
RegDeleteKeyW
RegDeleteKeyA
SetThreadToken
DuplicateToken
OpenThreadToken
shell32
SHGetDesktopFolder
mssip32
CryptSIPVerifyIndirectData
CryptSIPCreateIndirectData
ncobjapi
WmiDestroyObject
Sections
.text Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 2KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX1 Size: 82KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 4KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 140KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ