Behavioral task
behavioral1
Sample
c130562d1cb2e51cce68adaff1cfc35d5f369216221114b64eebe4c47fc877c1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c130562d1cb2e51cce68adaff1cfc35d5f369216221114b64eebe4c47fc877c1.exe
Resource
win10v2004-20220812-en
General
-
Target
c130562d1cb2e51cce68adaff1cfc35d5f369216221114b64eebe4c47fc877c1
-
Size
182KB
-
MD5
34f583d7943cd733b4365635abedae97
-
SHA1
bee1da894d55afb3645c429732afafe0f4d61881
-
SHA256
c130562d1cb2e51cce68adaff1cfc35d5f369216221114b64eebe4c47fc877c1
-
SHA512
af5f834cf7b069ad141168161a699f3b30abc411f8d6b0af9dd895f26d5270b1ad65510ac571bce0b0808c74a21c132a07fd74b5afe6a67b49ace60b42500f60
-
SSDEEP
1536:9pk9/PXe4p6qr29EjLJ3AdmovrIRi5NhgjThxYF9U11HRI:9Se4p6WjLqdP1vg5xiUbHRI
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
c130562d1cb2e51cce68adaff1cfc35d5f369216221114b64eebe4c47fc877c1.exe windows x86
c0606fc6b6bc5840f51cd8455a00369a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetCommandLineA
GetVersion
ExitProcess
RtlUnwind
GetLastError
CloseHandle
WriteFile
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DebugBreak
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
OpenProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
SetConsoleCtrlHandler
GetCPInfo
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
FlushFileBuffers
IsBadWritePtr
IsBadReadPtr
HeapValidate
SetStdHandle
SetUnhandledExceptionFilter
HeapReAlloc
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
GetStringTypeA
GetStringTypeW
IsBadCodePtr
MultiByteToWideChar
LCMapStringA
LCMapStringW
advapi32
RegCreateKeyExA
OpenProcessToken
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegSetValueExA
user32
ExitWindowsEx
Sections
UPX0 Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE