Behavioral task
behavioral1
Sample
7b0ee4a7c81e03e8c32c016e117ace4088b5126870da22087b2644a998f0a253.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7b0ee4a7c81e03e8c32c016e117ace4088b5126870da22087b2644a998f0a253.exe
Resource
win10v2004-20221111-en
General
-
Target
7b0ee4a7c81e03e8c32c016e117ace4088b5126870da22087b2644a998f0a253
-
Size
190KB
-
MD5
303dd6c0ca576c444ed704389dc1ca71
-
SHA1
293119d4601d0602002421551f3108d643ce89fb
-
SHA256
7b0ee4a7c81e03e8c32c016e117ace4088b5126870da22087b2644a998f0a253
-
SHA512
4fcf247740e0b4240b8ceaf13152682a62fe6a5af06dcc5b57312d42e37e89ada14fe696066d0cd1f22a9aa9e9a18d961aeb3231cbcd031f7b8c87cd69c77c35
-
SSDEEP
3072:sKyugU2MT6AwuzbSYkXxn6fJo3l4NRYyFOiq2odioOYJESUhVaxchX:5yugxAnzbSlXx6WqNGy9qHditYJEFh0Y
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
7b0ee4a7c81e03e8c32c016e117ace4088b5126870da22087b2644a998f0a253.exe windows x86
1b8509bc67e7a4acfb5c6cec96a26c5d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_vsnwprintf
_amsg_exit
_initterm
_XcptFilter
__dllonexit
memcpy
realloc
free
towlower
towupper
iswspace
wcspbrk
wcschr
wcsstr
malloc
memset
wcsrchr
wcsncmp
_wcsnicmp
_wtol
_onexit
_lock
_wcsicmp
_wtoi
iswdigit
bsearch
_beginthreadex
_unlock
memmove
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetModuleHandleW
GetLastError
GetVersionExW
VirtualQuery
MultiByteToWideChar
lstrlenW
lstrcmpiW
DeleteCriticalSection
HeapDestroy
lstrcpynW
lstrcatW
FreeLibrary
lstrlenA
LoadResource
FindResourceW
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CompareStringW
WideCharToMultiByte
ExpandEnvironmentStringsW
SizeofResource
GetSystemInfo
SetErrorMode
WaitForSingleObject
GetExitCodeThread
SetLastError
GetFileAttributesW
InterlockedDecrement
GetWindowsDirectoryW
InterlockedIncrement
QueryDosDeviceW
GetVersion
CreateFileA
DeviceIoControl
CreateFileW
CloseHandle
DebugBreak
GetDriveTypeW
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
user32
CharPrevW
CharNextW
CharNextA
advapi32
RegEnumKeyExW
RegEnumValueW
TraceMessage
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
ole32
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CoCreateInstance
mpr
WNetGetConnectionW
WNetAddConnection2W
WNetCancelConnection2W
shlwapi
PathGetCharTypeW
PathGetCharTypeA
netapi32
DsRoleFreeMemory
NetApiBufferFree
security
DeleteSecurityPackageA
DeleteSecurityContext
QuerySecurityContextToken
RevertSecurityContext
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX0 Size: 2KB - Virtual size: 45KB
IMAGE_SCN_MEM_READ
UPX1 Size: 3KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX2 Size: 512B - Virtual size: 45KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 138KB - Virtual size: 273KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX3 Size: 3KB - Virtual size: 17KB
IMAGE_SCN_MEM_READ
UPX4 Size: 2KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX5 Size: 512B - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ