Behavioral task
behavioral1
Sample
f0e12f23b0b6aa944f952e87d153930a369a48e77616aeaac5fd4fb4687a9803.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f0e12f23b0b6aa944f952e87d153930a369a48e77616aeaac5fd4fb4687a9803.exe
Resource
win10v2004-20221111-en
General
-
Target
f0e12f23b0b6aa944f952e87d153930a369a48e77616aeaac5fd4fb4687a9803
-
Size
36KB
-
MD5
38d8057934ef5885aa20a3b9ddb330c6
-
SHA1
bdc75fc9b85a545a04bd9980537e5992ee84f216
-
SHA256
f0e12f23b0b6aa944f952e87d153930a369a48e77616aeaac5fd4fb4687a9803
-
SHA512
150b6f0c8f1105a7c26713cb0c78b63e660881c88585790cd9d1d731c5e3ddddd519eaf7f0b2d4d84485611736ef055571bfa4bd022ce3fcfe6bffeba357466f
-
SSDEEP
768:v37U3d5WRTlLXdXVMRB9H8lQY9pNJPnueO:/o3d2l5GRzH8lvPnue
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
resource yara_rule sample upx
Files
-
f0e12f23b0b6aa944f952e87d153930a369a48e77616aeaac5fd4fb4687a9803.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE