Behavioral task
behavioral1
Sample
bb489aefad95eced379739824307d99464460965da15447d77133784204901ae.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bb489aefad95eced379739824307d99464460965da15447d77133784204901ae.exe
Resource
win10v2004-20221111-en
General
-
Target
bb489aefad95eced379739824307d99464460965da15447d77133784204901ae
-
Size
2.0MB
-
MD5
e749155732cab04bb55f349d584cea6f
-
SHA1
9124675a8b2794cc70b43eb0e6191387d3ad9500
-
SHA256
bb489aefad95eced379739824307d99464460965da15447d77133784204901ae
-
SHA512
110b39378fb109cc62c58585c24de4b1dd71defc5d2ecae56e398f7799c0099257bcd4599c48071d7f4b5faef8fb049788881f2d27ea3ee0174fcbb93c20b1b8
-
SSDEEP
24576:djUEZZVD1VvlJv6/NUgaBRSl4w4IBt+lsEIWtV5U4kdF78qG1hyk4zUHYLWz4PB0:/XagLSBBwGWtV7kH8R0RwixY
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
bb489aefad95eced379739824307d99464460965da15447d77133784204901ae.exe windows x86
8193b85febbd45439f9a0f279e78fe12
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
GetActiveObject
advapi32
RegCloseKey
user32
PeekMessageA
kernel32
WaitForMultipleObjectsEx
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msimg32
AlphaBlend
gdi32
EndPage
version
GetFileVersionInfoW
ole32
IsAccelerator
comctl32
ImageList_GetDragImage
winspool.drv
OpenPrinterW
shell32
SHGetSpecialFolderLocation
wininet
InternetCloseHandle
urlmon
URLDownloadToFileW
comdlg32
GetOpenFileNameW
wsock32
inet_ntoa
crypt32
CertAddCertificateContextToStore
shdocvw
DoOrganizeFavDlg
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 60B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 570KB - Virtual size: 570KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ