Behavioral task
behavioral1
Sample
a60ab5b3d233eebc7a240dbca5a6b5ac7f37d257e7c200ea2fdb33501ba30437.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a60ab5b3d233eebc7a240dbca5a6b5ac7f37d257e7c200ea2fdb33501ba30437.exe
Resource
win10v2004-20220812-en
General
-
Target
a60ab5b3d233eebc7a240dbca5a6b5ac7f37d257e7c200ea2fdb33501ba30437
-
Size
268KB
-
MD5
aa78d46a61e7e53b3f4717b6b731e254
-
SHA1
e67d7c2fd1f76d145b76091a04984b5c7a0189e3
-
SHA256
a60ab5b3d233eebc7a240dbca5a6b5ac7f37d257e7c200ea2fdb33501ba30437
-
SHA512
67117cbad3b206f11e1c7f8a0787bb481b3ffe48904688d19dfa0e9cd2b0be0bc840781fabbed3f95b01239391694c8a0b5aa54934425f4002e41a0c9ce2218d
-
SSDEEP
6144:x5q4MjTknKcjwzfxOZ9TdIEHFJW4CBEcdCfY1xaiqfIpvN20VEbVDy:hATkKbbxI9CEHFJzCCsCfYWivpvN20T
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
a60ab5b3d233eebc7a240dbca5a6b5ac7f37d257e7c200ea2fdb33501ba30437.exe windows x86
3039a04ea8ae6568d1f1f38e4ea28e48
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertOIDToAlgId
CryptMsgOpenToDecode
CertDuplicateCertificateContext
CryptMsgGetParam
CertEnumCertificatesInStore
CertDuplicateStore
CryptMsgUpdate
CertGetNameStringA
CertCloseStore
CertCompareCertificateName
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenStore
CryptDecodeObject
CryptMsgClose
wintrust
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
kernel32
GetLastError
GetModuleHandleA
GetModuleFileNameW
MoveFileW
MoveFileA
GetModuleFileNameA
MultiByteToWideChar
WaitForSingleObject
CreateSemaphoreA
SetEvent
CreateEventA
GetSystemTime
FreeLibrary
InitializeCriticalSection
LoadLibraryA
GetExitCodeThread
WaitForMultipleObjects
GetVersionExA
GetCurrentThreadId
LoadResource
Sleep
GetSystemInfo
RaiseException
ExitProcess
GetCurrentProcess
HeapCreate
IsBadWritePtr
TlsAlloc
GetStartupInfoA
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetACP
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
lstrcmpA
GetProcAddress
user32
CharUpperA
advapi32
RegSetValueExA
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
CryptGetHashParam
ole32
StringFromCLSID
scecli
SceStartTransaction
SceRegisterRegValues
SceAddToNameList
DllUnregisterServer
SceDcPromoCreateGPOsInSysvolEx
SceGetServerProductType
kbdkaz
KbdLayerDescriptor
Sections
UPX0 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.kREZn Size: 4KB - Virtual size: 415KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 91KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ocUcy Size: 512B - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.XtjX Size: 2KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 131KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xQ Size: 5KB - Virtual size: 793KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ